CVE-2018-16541 — Use After Free in Ghostscript

CWE-416 — Use After Free9 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.5%
top 36.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Artifex GhostscriptCanonical Ubuntu LinuxDebian Linux+6 more
Timeline
PublishedSep 5
Latest updateMay 14

Description

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶Debianartifex/ghostscript< 9.22~dfsg-3+3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, Enterprise Linux 7.6

Patches

Patch: www.artifex.com ↗Patch: www.artifex.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-m76g-5q68-xv2c: In Artifex Ghostscript before 9↗2022-05-14
▶
CVEList
CVE-2018-16541: In Artifex Ghostscript before 9↗2018-09-05
▶
OSV
CVE-2018-16541: In Artifex Ghostscript before 9↗2018-09-05
▶

📋Vendor Advisories

3
Ubuntu
Ghostscript vulnerabilities↗2018-09-19
▶
Red Hat
ghostscript: Incorrect free logic in pagedevice replacement (699664)↗2018-09-06
▶
Debian
CVE-2018-16541: ghostscript - In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript ...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-16541 ghostscript: incorrect free logic in pagedevice replacement (699664) [fedora-all]↗2018-09-06
▶
Bugzilla
CVE-2018-16541 ghostscript: Incorrect free logic in pagedevice replacement (699664)↗2018-09-06
▶
CVE-2018-16541 — Use After Free in Artifex Ghostscript | cvebase