CVE-2016-8602

Name: CVE-2016-8602
Creator: NVD / NIST
Published: 2017-04-14T18:59:00.877+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.24%

Last modified Jun 17, 2026

CVE-2016-8602 is a vulnerability of currently unknown severity. The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.. EPSS estimates a 3.24% chance of exploitation in the next 30 days.

Description

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.

Metrics

EPSS Probability

3.24%

86.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-704

Affected Software

Vendor	Product	Versions
Artifex	Ghostscript	<= 9.20

References

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=f5c7555c303
http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691
http://www.openwall.com/lists/oss-security/2016/10/11/5Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/11/7Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95311Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=697203Issue Tracking, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1383940Issue Tracking, Patch
https://ghostscript.com/doc/9.21/History9.htmPatch, Vendor Advisory
https://security.gentoo.org/glsa/201702-31
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=f5c7555c303
http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691
http://www.openwall.com/lists/oss-security/2016/10/11/5Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/11/7Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95311Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=697203Issue Tracking, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1383940Issue Tracking, Patch
https://ghostscript.com/doc/9.21/History9.htmPatch, Vendor Advisory
https://security.gentoo.org/glsa/201702-31

Timeline

Published: Apr 14, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-8602?

How severe is CVE-2016-8602?

Severity scoring for CVE-2016-8602 is pending analysis. The EPSS model estimates a 3.24% probability of exploitation in the next 30 days.

How do I fix CVE-2016-8602?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-8602?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST