PT-2018-3466 · Artifex+5 · Ghostscript+5
Tavis Ormandy
·
Publicado
2018-08-23
·
Atualizado
2024-06-15
·
CVE-2018-16540
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Artifex Ghostscript versions prior to 9.24
Description:
The issue is related to a use-after-free in copydevice handling when processing crafted PostScript files with the builtin PDF14 converter. This could allow attackers to crash the interpreter or potentially have other unspecified impacts. Exploitation of the vulnerability may enable an attacker to cause a denial of service using a specially crafted PostScript file.
Recommendations:
For versions prior to 9.24, update to version 9.24 or later to resolve the issue. As a temporary workaround, consider restricting the use of the builtin PDF14 converter until a patch is available. Avoid processing untrusted or specially crafted PostScript files with the affected converter to minimize the risk of exploitation.
Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Ghostscript
Red Hat
Suse
Ubuntu