CVE-2018-16509
published 2018-12-03CVE-2018-16509: It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER…
PriorityP184high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
92.50%
99.8th percentile
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | < 9.25 | 9.25 |
| artifex | ghostscript | < 9.24 | 9.24 |
| artifex | ghostscript | — | — |
| artifex | ghostscript | — | — |
| artifex | ghostscript | >= 0 < 9.25~dfsg-1 | 9.25~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.25~dfsg-1 | 9.25~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.25~dfsg-1 | 9.25~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.25~dfsg-1 | 9.25~dfsg-1 |
| artifex | gpl_ghostscript | < 9.26 | 9.26 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ghostscript | < ghostscript 9.25~dfsg-1 (bookworm) | ghostscript 9.25~dfsg-1 (bookworm) |
| debian | ghostscript | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2018-16509 exploits a -dSAFER bypass in Ghostscript via a failed restore (grestore) in PostScript to disable LockSafetyParams and avoid invalidaccess, enabling arbitrary command execution via the 'pipe' instruction. ↗
- →The vulnerability is reachable via libraries such as ImageMagick that invoke Ghostscript; monitor for Ghostscript process spawning from image-processing services. ↗
- →Detect specially crafted PostScript (.ps) files submitted to services that invoke Ghostscript; the exploit payload is embedded in a PostScript document. ↗
- →CVE-2018-16802 (incomplete fix for CVE-2018-16509) abuses the 'pipe' instruction in PostScript; alert on Ghostscript processes executing pipe-based commands. ↗
- →Ghostscript versions before 9.25 are vulnerable; flag invocations of ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7 even after RHSA-2018:2918 patching. ↗
- →The Metasploit module targets Unix (in-memory CMD), PowerShell (in-memory), and Linux (dropper) platforms; dropper payloads are written to a writable directory (default /tmp). ↗
- ·CVE-2018-16802 is also an incomplete fix for CVE-2018-16509; fixed in Ghostscript 9.25~dfsg-1 on Debian. ↗
- ·The Metasploit module payload space for the Unix in-memory target is capped at 4089 bytes (4096 total); larger payloads require the dropper target. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vulncheck7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ghostscript: -dSAFER escape in .charkeys (701841)
vendor_redhat·2019-11-14·CVSS 7.8
CVE-2019-14869 [HIGH] CWE-648 ghostscript: -dSAFER escape in .charkeys (701841)
ghostscript: -dSAFER escape in .charkeys (701841)
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.
A flaw was found in the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execu
Red Hat
ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
vendor_redhat·2019-08-28·CVSS 7.8
CVE-2019-14813 [HIGH] CWE-648 ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
A flaw was found in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https
Red Hat
ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
vendor_redhat·2019-08-28·CVSS 7.8
CVE-2019-14812 [HIGH] CWE-648 ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
A flaw was found in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : http
Red Hat
ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
vendor_redhat·2019-08-28·CVSS 7.8
CVE-2019-14811 [HIGH] CWE-648 ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
A flaw was found in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Mitigation: Please refer to the "Mitigation" section of CVE-20
Red Hat
ghostscript: -dSAFER escape via .buildfont1 (701394)
vendor_redhat·2019-08-12·CVSS 7.8
CVE-2019-10216 [HIGH] CWE-648 ghostscript: -dSAFER escape via .buildfont1 (701394)
ghostscript: -dSAFER escape via .buildfont1 (701394)
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Red Hat
ghostscript: missing attack vector protections for CVE-2019-6116
vendor_redhat·2019-05-02·CVSS 7.8
CVE-2019-3839 [HIGH] CWE-648 ghostscript: missing attack vector protections for CVE-2019-6116
ghostscript: missing attack vector protections for CVE-2019-6116
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
It was found that some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This
Red Hat
ghostscript: forceput in DefineResource is still accessible (700576)
vendor_redhat·2019-03-21·CVSS 7.8
CVE-2019-3838 [HIGH] CWE-648 ghostscript: forceput in DefineResource is still accessible (700576)
ghostscript: forceput in DefineResource is still accessible (700576)
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
It was found that the forceput operator could be extracted from the DefineResource method. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package
Red Hat
ghostscript: superexec operator is available (700585)
vendor_redhat·2019-03-21·CVSS 7.8
CVE-2019-3835 [HIGH] CWE-648 ghostscript: superexec operator is available (700585)
ghostscript: superexec operator is available (700585)
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscript (Red Hat Enterpri
Red Hat
ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
vendor_redhat·2019-01-23·CVSS 7.8
CVE-2019-6116 [HIGH] ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER constraints.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For addit
Red Hat
ghostscript: incomplete fix for CVE-2018-16509
vendor_redhat·2018-12-03·CVSS 7.8
CVE-2018-16863 [HIGH] CWE-184 ghostscript: incomplete fix for CVE-2018-16509
ghostscript: incomplete fix for CVE-2018-16509
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document.
Statement: This vulnerability affects only Red Hat Enterprise Linux version 7. Red Hat Enterprise Linux version 6 is not affected by this vulnerability b
Red Hat
ghostscript: access bypass in psi/zicc.c (700169)
vendor_redhat·2018-11-20·CVSS 7.8
CVE-2018-19476 [HIGH] CWE-843 ghostscript: access bypass in psi/zicc.c (700169)
ghostscript: access bypass in psi/zicc.c (700169)
psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscript
Red Hat
ghostscript: access bypass in psi/zfjbig2.c (700168)
vendor_redhat·2018-11-20·CVSS 7.8
CVE-2018-19477 [HIGH] CWE-843 ghostscript: access bypass in psi/zfjbig2.c (700168)
ghostscript: access bypass in psi/zfjbig2.c (700168)
psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostsc
Red Hat
ghostscript: access bypass in psi/zdevice2.c (700153)
vendor_redhat·2018-11-20·CVSS 7.8
CVE-2018-19475 [HIGH] CWE-119 ghostscript: access bypass in psi/zdevice2.c (700153)
ghostscript: access bypass in psi/zdevice2.c (700153)
psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise L
Red Hat
ghostscript: Type confusion in setpattern (700141)
vendor_redhat·2018-11-20·CVSS 7.8
CVE-2018-19134 [HIGH] ghostscript: Type confusion in setpattern (700141)
ghostscript: Type confusion in setpattern (700141)
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/supp
Red Hat
ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
vendor_redhat·2018-11-20·CVSS 7.8
CVE-2018-19478 [HIGH] ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linu
Red Hat
ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
vendor_redhat·2018-11-14·CVSS 7.8
CVE-2018-19409 [HIGH] CWE-391 ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Pa
Red Hat
ghostscript: 1Policy operator allows a sandbox protection bypass
vendor_redhat·2018-10-12·CVSS 7.8
CVE-2018-18284 [HIGH] ghostscript: 1Policy operator allows a sandbox protection bypass
ghostscript: 1Policy operator allows a sandbox protection bypass
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscri
Red Hat
ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
vendor_redhat·2018-10-10·CVSS 7.8
CVE-2018-17961 [HIGH] CWE-460 ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/c
Red Hat
ghostscript: Saved execution stacks can leak operator arrays
vendor_redhat·2018-10-09·CVSS 7.8
CVE-2018-18073 [HIGH] CWE-460 ghostscript: Saved execution stacks can leak operator arrays
ghostscript: Saved execution stacks can leak operator arrays
Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Enterprise Linux 5) - Will
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2018-09-19
CVE-2018-11645 Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
Tavis Ormandy discovered multiple security issues in Ghostscript. If a user
or automated system were tricked into processing a specially crafted file,
a remote attacker could possibly use these issues to access arbitrary
files, execute arbitrary code, or cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ghostscript: User-writable error exception table
vendor_redhat·2018-09-19·CVSS 7.8
CVE-2018-17183 [HIGH] CWE-460 ghostscript: User-writable error exception table
ghostscript: User-writable error exception table
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscrip
Red Hat
ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
vendor_redhat·2018-09-12·CVSS 7.8
CVE-2018-16802 [HIGH] CWE-20 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 7. This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5 and 6.
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Package: ghostscript (Red Hat Ente
Red Hat
ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
vendor_redhat·2018-09-06·CVSS 7.8
CVE-2018-16542 [HIGH] ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter.
It was discovered that ghostscript did not properly handle certain stack overflow error conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.
Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle.
Red Hat
ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
vendor_redhat·2018-09-06·CVSS 7.8
CVE-2018-16539 [HIGH] CWE-377 ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.
It was discovered that the ghostscript did not properly restrict access to files open prior to enabling the -dSAFER mode. An attacker could possibly exploit this to bypass the -dSAFER protection and disclose the content of affected files via a specially crafted PostScript document.
Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and mainte
Red Hat
ghostscript: use-after-free in copydevice handling (699661)
vendor_redhat·2018-09-06·CVSS 7.8
CVE-2018-16540 [HIGH] CWE-416 ghostscript: use-after-free in copydevice handling (699661)
ghostscript: use-after-free in copydevice handling (699661)
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.
It was discovered that the ghostscript PDF14 compositor did not properly handle the copying of a device. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.
Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support a
Red Hat
ghostscript: Uninitialized memory access in the aesdecode operator (699665)
vendor_redhat·2018-09-06·CVSS 7.8
CVE-2018-15911 [HIGH] CWE-456 ghostscript: Uninitialized memory access in the aesdecode operator (699665)
ghostscript: Uninitialized memory access in the aesdecode operator (699665)
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
It was discovered that ghostscript did not properly verify the key used in aesdecode. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.
Statement: This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle.
Red Hat
ghostscript: shading_param incomplete type checking (699660)
vendor_redhat·2018-08-28·CVSS 7.8
CVE-2018-15909 [HIGH] CWE-843 ghostscript: shading_param incomplete type checking (699660)
ghostscript: shading_param incomplete type checking (699660)
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
It was discovered that the ghostscript .shfill operator did not properly validate certain types. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.
Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. Thi
Red Hat
ghostscript: /invalidaccess bypass after failed restore (699654)
vendor_redhat·2018-08-21·CVSS 7.8
CVE-2018-16509 [HIGH] ghostscript: /invalidaccess bypass after failed restore (699654)
ghostscript: /invalidaccess bypass after failed restore (699654)
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document.
Statement: This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle
Red Hat
ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
vendor_redhat·2018-04-20·CVSS 7.8
CVE-2018-10194 [HIGH] CWE-119 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errat
Debian
CVE-2018-16802: ghostscript - An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restorati...
vendor_debian·2018·CVSS 7.8
CVE-2018-16802 [HIGH] CVE-2018-16802: ghostscript - An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restorati...
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Scope: local
bookworm: resolved (fixed in 9.25~dfsg-1)
bullseye: resolved (fixed in 9.25~dfsg-1)
forky: resolved (fixed in 9.25~dfsg-1)
sid: resolved (fixed in 9.25~dfsg-1)
trixie: resolved (fixed in 9.25~dfsg-1)
Debian
CVE-2018-16509: ghostscript - An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restorati...
vendor_debian·2018·CVSS 7.8
CVE-2018-16509 [HIGH] CVE-2018-16509: ghostscript - An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restorati...
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
Scope: local
bookworm: resolved (fixed in 9.25~dfsg-1)
bullseye: resolved (fixed in 9.25~dfsg-1)
forky: resolved (fixed in 9.25~dfsg-1)
sid: resolved (fixed in 9.25~dfsg-1)
trixie: resolved (fixed in 9.25~dfsg-1)
Debian
CVE-2018-16863: ghostscript - It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker c...
vendor_debian·2018·CVSS 7.8
CVE-2018-16863 [HIGH] CVE-2018-16863: ghostscript - It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker c...
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-r3qx-w5mm-cr27: An issue was discovered in Artifex Ghostscript before 9
ghsa_unreviewed·2022-05-13·CVSS 7.8
CVE-2018-16802 [HIGH] GHSA-r3qx-w5mm-cr27: An issue was discovered in Artifex Ghostscript before 9
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
GHSA
GHSA-98rm-3v6h-p8j6: An issue was discovered in Artifex Ghostscript before 9
ghsa_unreviewed·2022-05-13
CVE-2018-16509 [HIGH] GHSA-98rm-3v6h-p8j6: An issue was discovered in Artifex Ghostscript before 9
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
GHSA
GHSA-83g5-f7jm-c8fc: It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509
ghsa_unreviewed·2022-05-13·CVSS 7.8
CVE-2018-16863 [HIGH] CWE-184 GHSA-83g5-f7jm-c8fc: It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
OSV
CVE-2018-16802: An issue was discovered in Artifex Ghostscript before 9
osv·2018-09-10·CVSS 7.8
CVE-2018-16802 [HIGH] CVE-2018-16802: An issue was discovered in Artifex Ghostscript before 9
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
OSV
CVE-2018-16509: An issue was discovered in Artifex Ghostscript before 9
osv·2018-09-05·CVSS 7.8
CVE-2018-16509 [HIGH] CVE-2018-16509: An issue was discovered in Artifex Ghostscript before 9
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
VulnCheck
Artifex Ghostscript Restoration of Privilege Vulnerability
vulncheck·2018·CVSS 7.8
CVE-2018-16509 [HIGH] Artifex Ghostscript Restoration of Privilege Vulnerability
Artifex Ghostscript Restoration of Privilege Vulnerability
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
Affected: debian debian_linux
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf
Exploit PoC: https://vulncheck.com/xdb/cb9953ec760c
No detection rules found.
Exploit-DB
Ghostscript - Failed Restore Command Execution (Metasploit)
exploitdb·2018-09-10
CVE-2018-16509 Ghostscript - Failed Restore Command Execution (Metasploit)
Ghostscript - Failed Restore Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule /dev/tty'
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::CmdStager
include Msf::Exploit::Powershell
def initialize(info = {})
super(update_info(info,
'Name' => 'Ghostscript Failed Restore Command Execution',
'Description' => %q{
This module exploits a -dSAFER bypass in Ghostscript to execute
arbitrary commands by handling a failed restore (grestore) in
PostScript to disable LockSafetyParams and avoid invalidaccess.
This vulnerability is reachable via libraries such as ImageMagick,
and this module provides the latest vector for Ghostscript.
For previous G
Metasploit
Ghostscript Failed Restore Command Execution
metasploit
Ghostscript Failed Restore Command Execution
Ghostscript Failed Restore Command Execution
This module exploits a -dSAFER bypass in Ghostscript to execute arbitrary commands by handling a failed restore (grestore) in PostScript to disable LockSafetyParams and avoid invalidaccess. This vulnerability is reachable via libraries such as ImageMagick.
Bugzilla
CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys (701841)
bugzilla·2019-11-05·CVSS 7.8
CVE-2019-14869 [HIGH] CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys (701841)
CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys (701841)
While .charkeys cannot be called directly, it is called by .loadwofffont, which in turn can be recovered from .loadfontfile. Using a stack overflow and error handlers, .charkeys can be crashed at a convenient location and .forceput recovered from the stack.
This can be used to disable -dSAFER and, for example, access files outside of the restricted area, or command execution.
The vulnerability is not effective against ghostscript 9.50 thanks to the reimplementation of the SAFER feature.
Reference:
https://bugs.ghostscript.com/show_bug.cgi?id=701841
Discussion:
Upstream fix:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
---
The .charkey operator was vulnerable in one way or another (`superexec
Bugzilla
CVE-2019-14812 ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
bugzilla·2019-08-20·CVSS 7.8
CVE-2019-14812 [HIGH] CVE-2019-14812 ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
CVE-2019-14812 ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
In Ghostscript 9.27, some ephemeral routines in .setuserparams2 can expose .forceput operator when hooking errors. This issue is similar to upstream bug https://bugs.ghostscript.com/show_bug.cgi?id=700317.
The actual root-cause is in .setuserparams2 however there is no direct path to invoke the operator.
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=Resource/Init/gs_lev2.ps;h=98d55fe74251e2b8f384a0a97d0a92a9f88949b6;hb=ebfaa2db4cb518a2bc99c1532d4429201a13dfab#l156
156 /userparams .systemvar 3 1 roll .forceput % userparams is read-only
157 } executeonly
158 {
159 pop pop
160 } ifelse
161 } forall
We can reach .setuserparams2 via setuserparams.
http://git.ghostscript.com/?p=ghostpdl.git;
Bugzilla
CVE-2019-14811 ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
bugzilla·2019-08-20·CVSS 7.8
CVE-2019-14811 [HIGH] CVE-2019-14811 ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
CVE-2019-14811 ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
In Ghostscript 9.27, some ephemeral routines in .pdf_hook_DSC_Creator can expose .forceput operator when hooking errors. This issue is similar to upstream bug https://bugs.ghostscript.com/show_bug.cgi?id=700317.
There is no direct path to reach .pdf_hook_DSC_Creator however it can be obtained from .pdfdsc.
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=Resource/Init/gs_pdfwr.ps;h=00c19faf3c4169fc26f7d35e759b94a7444d63a8;hb=ebfaa2db4cb518a2bc99c1532d4429201a13dfab#l651
651 } bind .makeoperator .forceput
652 systemdict /.pdf_hooked_DSC_Creator //true .forceput
653 } executeonly if
654 pop
655 } if
This can be used to disable -dSAFER and, for example, access files outside of the res
Bugzilla
CVE-2019-14813 ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
bugzilla·2019-08-20·CVSS 7.8
CVE-2019-14813 [HIGH] CVE-2019-14813 ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
CVE-2019-14813 ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
In Ghostscript 9.27, some ephemeral routines in setsystemparams can expose .forceput operator when hooking errors. This issue is similar to upstream bug https://bugs.ghostscript.com/show_bug.cgi?id=700317.
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=Resource/Init/gs_lev2.ps;h=98d55fe74251e2b8f384a0a97d0a92a9f88949b6;hb=ebfaa2db4cb518a2bc99c1532d4429201a13dfab#l227
227 //pssystemparams 3 1 roll .forceput % pssystemparams is read-only
228 } executeonly
229 { pop pop
230 }
231 ifelse
232 }
233 forall pop
Reference:
https://bugs.ghostscript.com/show_bug.cgi?id=701443
Discussion:
Upstream fix :
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd3
Bugzilla
CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)
bugzilla·2019-08-02·CVSS 7.8
CVE-2019-10216 [HIGH] CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)
CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)
The .buildfont1 does not sufficiently protect its environment. A specially crafted PostScript script can override the typecheck error handler to retrieve a reference to .forceput. This can be used to disable -dSAFER and, for example, access files outside of the restricted area.
Discussion:
Acknowledgments:
Name: Artifex Software
Upstream: Netanel (Cloudinary)
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1740198]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2462 https://access.redhat.com/erra
Bugzilla
CVE-2019-3835 ghostscript: superexec operator is available (700585)
bugzilla·2019-02-15·CVSS 7.8
CVE-2019-3835 [HIGH] CVE-2019-3835 ghostscript: superexec operator is available (700585)
CVE-2019-3835 ghostscript: superexec operator is available (700585)
The superexec operator is available via either systemdict or internaldict, depending on ghostscript version. An attacker could use this flaw to bypass -dSAFER restrictions and, for example, have access to the file system outside of the designated restricted directories.
Discussion:
External References:
https://bugs.ghostscript.com/show_bug.cgi?id=700585
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
Upstream fixes:
* Fix bug 700585: Restrict superexec and remove it from internals and gs_cet.ps
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917
* Bug 700585: Obliterate "superexec". We don't need it, nor do any kn
Bugzilla
CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible (700576)
bugzilla·2019-02-15·CVSS 7.8
CVE-2019-3838 [HIGH] CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible (700576)
CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible (700576)
The .forceput (or .forcedef depending on the ghostscript version) is still accessible via DefineResource. An attacker could use this flaw to bypass -dSAFER restriction and, for example, have access to the file system outside of the designated restricted directories.
Discussion:
External References:
https://bugs.ghostscript.com/show_bug.cgi?id=700576
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
The following upstream fixes resolve the issue :
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a
---
Acknowledgments:
Nam
Bugzilla
CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116
bugzilla·2019-02-07·CVSS 7.8
CVE-2019-3839 [HIGH] CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116
CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116
It was found that some additional operators and dictionaries were needed to be hidden in order to prevent other CVE-2019-6116 attacks.
Discussion:
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
Additional commit required for CVE-2019-6116 :
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4ec9ca7
+ http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=db24f25 to prevent pdf2dsc regression
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2019:0971 https://access.redhat.com/errata/RHSA-2019:0971
---
This issue has been addressed in the following products:
Red
Bugzilla
CVE-2019-6116 ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
bugzilla·2019-01-16·CVSS 7.8
CVE-2019-6116 [HIGH] CVE-2019-6116 ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
CVE-2019-6116 ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
It was found that operators did not sufficiently protect their calls to other sensitive operators.
An attacker could use this flaw to get access to sensitive operators, such as .forceput, and use these operators to disable the SAFER mode, and for example, get access to the file system outside of the restricted areas.
Discussion:
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
External References:
https://bugs.ghostscript.com/show_bug.cgi?id=700317
---
Acknowledgments:
Name: Tavis Ormandy (Google Project Zero)
---
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 16
Bugzilla
CVE-2018-19478 ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
bugzilla·2018-12-03·CVSS 7.8
CVE-2018-19478 [HIGH] CVE-2018-19478 ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
CVE-2018-19478 ghostscript: Attempting to open a carefully crafted PDF file results in long-running computation (699856)
Attempting to open a carefully crafted PDF results in a long-running computation. The page tree nodes are deeply nested where a child page tree node may be a descendent of multiple parents.
Upstream bug:
https://bugs.ghostscript.com/show_bug.cgi?id=699856
Upstream fix:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0a7e5a1c309fa0911b892fa40996a7d55d90bace
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1656319]
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
Statement:
Red Hat Enterprise Linux 6 is now in Maintenance Support
Bugzilla
CVE-2018-19134 ghostscript: Type confusion in setpattern (700141)
bugzilla·2018-12-03·CVSS 7.8
CVE-2018-19134 [HIGH] CVE-2018-19134 ghostscript: Type confusion in setpattern (700141)
CVE-2018-19134 ghostscript: Type confusion in setpattern (700141)
There is a missing type check in line 292 of zcolor.c:
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l292
Here `pPatInst` comes from the first array element of `pImpl`
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l289
which comes from `op`:
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l286
The type of `pPatInst` is not checked and is used in `r_ptr`, which accesses its `pstruct` value and then cast it in
Bugzilla
CVE-2018-19475 ghostscript: access bypass in psi/zdevice2.c (700153)
bugzilla·2018-11-28·CVSS 7.8
CVE-2018-19475 [HIGH] CVE-2018-19475 ghostscript: access bypass in psi/zdevice2.c (700153)
CVE-2018-19475 ghostscript: access bypass in psi/zdevice2.c (700153)
A vulnerability was found in Artifex Ghostscript before 9.26. The restore_page_device function in psi/zdevice2.c allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
References:
https://bugs.ghostscript.com/show_bug.cgi?id=700153
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3005fcb9bb160af199e761e03bc70a9f249a987e
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1654460]
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
-
Bugzilla
CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654) [fedora-all]
bugzilla·2018-11-28·CVSS 7.8
CVE-2018-16509 [HIGH] CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654) [fedora-all]
CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple sup
Bugzilla
CVE-2018-19477 ghostscript: access bypass in psi/zfjbig2.c (700168)
bugzilla·2018-11-28·CVSS 7.8
CVE-2018-19477 [HIGH] CVE-2018-19477 ghostscript: access bypass in psi/zfjbig2.c (700168)
CVE-2018-19477 ghostscript: access bypass in psi/zfjbig2.c (700168)
A vulnerability was found in Artifex Ghostscript before 9.26. A JBIG2Decode type confusion in psi/zfjbig2.c allows remote attackers to bypass intended access restrictions.
References:
https://bugs.ghostscript.com/show_bug.cgi?id=700168
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ef252e7dc214bcbd9a2539216aab9202848602bb
http://git.ghostscript.com/?p=ghostpdl.git;h=606a22e77e7f081781e99e44644cd0119f559e03
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1654470]
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-1650
Bugzilla
CVE-2018-19476 ghostscript: access bypass in psi/zicc.c (700169)
bugzilla·2018-11-28·CVSS 7.8
CVE-2018-19476 [HIGH] CVE-2018-19476 ghostscript: access bypass in psi/zicc.c (700169)
CVE-2018-19476 ghostscript: access bypass in psi/zicc.c (700169)
A vulnerability was found in Artifex Ghostscript before 9.26. A type confusion in setcolorspace in psi/zicc.c allows remote attackers to bypass intended access restrictions.
References:
https://bugs.ghostscript.com/show_bug.cgi?id=700169
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=67d760ab775dae4efe803b5944b0439aa3c0b04a
http://git.ghostscript.com/?p=ghostpdl.git;h=548bb434e81dadcc9f71adf891a3ef5bea8e2b4e
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1654465]
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Bugzilla
CVE-2018-16863 ghostscript: incomplete fix for CVE-2018-16509
bugzilla·2018-11-23·CVSS 7.8
CVE-2018-16863 [HIGH] CVE-2018-16863 ghostscript: incomplete fix for CVE-2018-16509
CVE-2018-16863 ghostscript: incomplete fix for CVE-2018-16509
It was found that the fix for CVE-2018-16509 provided in Red Hat Enterprise Linux 7 was not sufficient.
Discussion:
The full fix for CVE-2018-16509 (bug 1619748) consists of the following 4 upstream patches:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5516c614dc33
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=78911a01b67d
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=79cccf641486
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=520bb0ea7519
The RHSA-2018:2918 erratum for Red Hat Enterprise Linux 7 only included the first 2 fixes, and hence failed to fix CVE-2018-16509 completely.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3761 http
Bugzilla
CVE-2018-19409 ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
bugzilla·2018-11-22·CVSS 7.8
CVE-2018-19409 [HIGH] CVE-2018-19409 ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
CVE-2018-19409 ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
Upstream bug:
https://bugs.ghostscript.com/show_bug.cgi?id=700176
Upstream patch:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=661e8d8fb
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ea1b3ef43
References:
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1652584]
---
Upstream patches :
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=661e8d8fb
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ea1b3ef43
-
Bugzilla
CVE-2018-18284 ghostscript: 1Policy operator allows a sandbox protection bypass
bugzilla·2018-10-25·CVSS 7.8
CVE-2018-18284 [HIGH] CVE-2018-18284 ghostscript: 1Policy operator allows a sandbox protection bypass
CVE-2018-18284 ghostscript: 1Policy operator allows a sandbox protection bypass
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
References:
https://www.openwall.com/lists/oss-security/2018/10/16/2
https://bugs.chromium.org/p/project-zero/issues/detail?id=1696
git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1642943]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3834 https://access.redhat.com/errata/RHSA-2018:3834
---
Statement:
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and mainten
Bugzilla
CVE-2018-18073 ghostscript: Saved execution stacks can leak operator arrays
bugzilla·2018-10-24·CVSS 7.8
CVE-2018-18073 [HIGH] CVE-2018-18073 ghostscript: Saved execution stacks can leak operator arrays
CVE-2018-18073 ghostscript: Saved execution stacks can leak operator arrays
Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.
References:
http://www.openwall.com/lists/oss-security/2018/10/10/12
https://bugs.chromium.org/p/project-zero/issues/detail?id=1690
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=34cc326eb2c5695833361887fe0b32e8d987741c
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1642585]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3834 https://access.redhat.com/errata/RHSA-2018:3834
---
Statement:
Red Hat Enterprise Linux 6 is no
Bugzilla
CVE-2018-17961 ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
bugzilla·2018-10-24·CVSS 7.8
CVE-2018-17961 [HIGH] CVE-2018-17961 ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
CVE-2018-17961 ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. This issue exists because of an incomplete fix for CVE-2018-17183.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2
https://bugs.ghostscript.com/show_bug.cgi?id=699816
http://www.openwall.com/lists/oss-security/2018/10/09/4
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a54c9e61e7d0
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a6807394bd94
Discussion:
Created ghostscript tracking bugs for this issue
Bugzilla
CVE-2018-17183 ghostscript: User-writable error exception table
bugzilla·2018-09-24·CVSS 7.8
CVE-2018-17183 [HIGH] CVE-2018-17183 ghostscript: User-writable error exception table
CVE-2018-17183 ghostscript: User-writable error exception table
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.
Upstream patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=fb713b3818b52d8a6cf62c951eba2e1795ff9624
Upstream bug:
https://bugs.ghostscript.com/show_bug.cgi?id=699708
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1632472]
---
Note:
The fix creates some regression : https://bugs.ghostscript.com/show_bug.cgi?id=699832 (fix commit : http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=1778db6bc10)
---
This issue has been addressed in the following
Bugzilla
CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
bugzilla·2018-09-12·CVSS 7.8
CVE-2018-16802 [HIGH] CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
References:
https://seclists.org/oss-sec/2018/q3/228
https://seclists.org/oss-sec/2018/q3/229
https://seclists.org/oss-sec/2018/q3/233
Upstream Patches:
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=643b24db
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3e5d316b
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5812b1b7
Di
Bugzilla
CVE-2018-16540 ghostscript: use-after-free in copydevice handling (699661)
bugzilla·2018-09-06·CVSS 7.8
CVE-2018-16540 [HIGH] CVE-2018-16540 ghostscript: use-after-free in copydevice handling (699661)
CVE-2018-16540 ghostscript: use-after-free in copydevice handling (699661)
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.
External Reference:
https://www.kb.cert.org/vuls/id/332928
https://www.artifex.com/news/ghostscript-security-resolved/
Upstream Bug:
https://bugs.ghostscript.com/show_bug.cgi?id=699661
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=c432131c
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1625844]
---
Statement:
This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7
Bugzilla
CVE-2018-15911 ghostscript: Uninitialized memory access in the aesdecode operator (699665)
bugzilla·2018-09-06·CVSS 7.8
CVE-2018-15911 [HIGH] CVE-2018-15911 ghostscript: Uninitialized memory access in the aesdecode operator (699665)
CVE-2018-15911 ghostscript: Uninitialized memory access in the aesdecode operator (699665)
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
External Reference:
https://www.kb.cert.org/vuls/id/332928
Upstream Bug:
https://bugs.ghostscript.com/show_bug.cgi?id=699665
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=8e9ce501
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1625833]
---
Statement:
This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase
Bugzilla
CVE-2018-16539 ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
bugzilla·2018-09-06·CVSS 7.8
CVE-2018-16539 [HIGH] CVE-2018-16539 ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
CVE-2018-16539 ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.
External Reference:
https://www.kb.cert.org/vuls/id/332928
https://www.artifex.com/news/ghostscript-security-resolved/
Upstream Bug:
https://bugs.ghostscript.com/show_bug.cgi?id=699658
Upstream Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=a054156d
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1625840]
---
Statement:
This issue affects the versions of ghostscript as shipped with Red Hat Enterprise
Bugzilla
CVE-2018-15909 ghostscript: shading_param incomplete type checking (699660)
bugzilla·2018-08-23·CVSS 7.8
CVE-2018-15909 [HIGH] CVE-2018-15909 ghostscript: shading_param incomplete type checking (699660)
CVE-2018-15909 ghostscript: shading_param incomplete type checking (699660)
It was discovered that the ghostscript .shfill operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash ghostscript or, possibly, execute arbitrary code in the context of the ghostscript process.
Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0b6cd1918e1ec4ffd087400a754a845180a4522b
Discussion:
This patch is also required:
http://git.ghostscript.com/?p=ghostpdl.git;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6
---
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1622757]
---
Mitigation:
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
---
Sta
Bugzilla
CVE-2018-16542 ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
bugzilla·2018-08-23·CVSS 7.8
CVE-2018-16542 [HIGH] CVE-2018-16542 ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
CVE-2018-16542 ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
It was discovered that ghostscript did not properly handle certain stack overflow error conditions. A specially crafted PostScript document could exploit this to crash ghostscript or, possibly, execute arbitrary code in the context of the ghostscript process.
Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b575e1ec42
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1625827]
---
Acknowledgments:
Name: Tavis Ormandy (Google Project Zero)
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:2918 https://access.redhat.com/errata/RHSA-2018:2918
---
Statement:
This issue affects t
Bugzilla
CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654)
bugzilla·2018-08-21·CVSS 7.8
CVE-2018-16509 [HIGH] CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654)
CVE-2018-16509 ghostscript: /invalidaccess bypass after failed restore (699654)
It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. A specially crafted PostScript document could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands.
Discussion:
External References:
http://seclists.org/oss-sec/2018/q3/142
---
Acknowledgments:
Name: Tavis Ormandy (Google Project Zero)
---
Mediawiki was only introduced in OCP 3.x in version 3.6. Setting 3.5 and earlier as not affected. References:
https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/openshift3/mediawiki-apb
https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/openshift3/mediawiki-123
---
While the
Bugzilla
CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
bugzilla·2018-04-18·CVSS 7.8
CVE-2018-10194 [HIGH] CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
pdf_set_text_matrix in gdevpdts.c in Artifex Ghostscript through 9.18 allows remote attackers to cause a denial of service (spprint.c pprintg1 stack-based out-of-bounds write) or possibly execute arbitrary code via a crafted PDF document.
Discussion:
Upstream ticket:
https://bugs.ghostscript.com/show_bug.cgi?id=699255
Upstream patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879
---
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1569821]
---
oss-security:
http://www.openwall.com/lists/oss-security/2018/04/19/5
---
Statement:
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the
CTF
20190323-0ctf_tctf2019quals / README
ctf_writeups·2019
20190323-0ctf_tctf2019quals / README
# 0CTF/TCTF 2019 Quals
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20190323-0ctf_tctf2019quals/) of this writeup.**
- [0CTF/TCTF 2019 Quals](#0ctftctf-2019-quals)
- [Pwn](#pwn)
- [babyaegis](#babyaegis)
- [If on a winters night a traveler](#if-on-a-winters-night-a-traveler)
- [zerotask](#zerotask)
- [plang](#plang)
- [Vulnerability](#vulnerability)
- [Leak](#leak)
- [exploit](#exploit)
- [Web](#web)
- [Ghost Pepper](#ghost-pepper)
- [Failed Attempts](#failed-attempts)
- [Wallbreaker Easy](#wallbreaker-easy)
- [Solution 1: Bypass open_basedir](#solution-1-bypass-open_basedir)
- [Solution 2: Bypass disable_function with LD_PRELOAD](#solution-2-bypass-disable_function-with-ld_preload)
- [Failed Attempts](#failed-attempts-1)
- [Reverse](#reverse)
- [
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67dhttp://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486https://access.redhat.com/errata/RHSA-2018:3761https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67dhttp://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486https://access.redhat.com/errata/RHSA-2018:3761https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
2018-12-03
Published
Exploited in the wild