high7.8
CVE-2018-16802
An issue was discovered in Artifex Ghostscript before 9.25.
Impact
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Artifex | Ghostscript | before 9.25 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 18.04 |
| Redhat | Enterprise Linux Desktop | Version 7.0 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Redhat | Enterprise Linux Server Aus | Version 7.6 |
| Redhat | Enterprise Linux Server Eus | Version 7.6 |
| Redhat | Enterprise Linux Server Tus | Version 7.6 |
| Redhat | Enterprise Linux Workstation | Version 7.0 |
References
- NVD record
- CVE.org record
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3e5d316b72e3965b7968bb1d96baa137cd063ac6
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=643b24dbd002fb9c131313253c307cf3951b3d47
- https://access.redhat.com/errata/RHSA-2018:3834
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5812b1b78fc4d36fdc293b7859de69241140d590
- https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
- https://seclists.org/oss-sec/2018/q3/228
- https://seclists.org/oss-sec/2018/q3/229
- https://security.gentoo.org/glsa/201811-12
- https://usn.ubuntu.com/3768-1/
- https://www.debian.org/security/2018/dsa-4294
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3e5d316b72e3965b7968bb1d96baa137cd063ac6
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=643b24dbd002fb9c131313253c307cf3951b3d47
- https://access.redhat.com/errata/RHSA-2018:3834
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5812b1b78fc4d36fdc293b7859de69241140d590
- https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
- https://seclists.org/oss-sec/2018/q3/228
- https://seclists.org/oss-sec/2018/q3/229
- https://security.gentoo.org/glsa/201811-12
- https://usn.ubuntu.com/3768-1/
- https://www.debian.org/security/2018/dsa-4294