CVE-2018-16802
Summary
| CVE | CVE-2018-16802 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-09-10 16:29:00 UTC |
| Updated | 2023-11-07 02:53:00 UTC |
| Description | An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Artifex | Ghostscript | All | All | All | All |
| Application | Artifex | Ghostscript | All | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.ghostscript.com Git - ghostpdl.git/commit | git.ghostscript.com | ||
| USN-3768-1: Ghostscript vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| git.ghostscript.com Git - ghostpdl.git/commitdiff | git.ghostscript.com | ||
| git.ghostscript.com Git - ghostpdl.git/commit | git.ghostscript.com | ||
| git.ghostscript.com Git - ghostpdl.git/commitdiff | CONFIRM | git.ghostscript.com | Patch, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| oss-sec: Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? | MISC | seclists.org | Mailing List, Third Party Advisory |
| GPL Ghostscript: Multiple vulnerabilities (GLSA 201811-12) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| git.ghostscript.com Git - ghostpdl.git/commit | MISC | git.ghostscript.com | Third Party Advisory |
| Debian -- Security Information -- DSA-4294-1 ghostscript | DEBIAN | www.debian.org | Third Party Advisory |
| oss-sec: Re: Ghostscript 9.24 issues | MLIST | seclists.org | Mailing List, Third Party Advisory |
| [SECURITY] [DLA 1504-1] ghostscript security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| git.ghostscript.com Git - ghostpdl.git/commit | MISC | git.ghostscript.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.