PT-2018-2295 · Artifex+5 · Artifex Ghostscript+5

Tavis Ormandy · Published 2018-08-21 · Updated 2024-06-15 · CVE-2018-16509

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24

Description An issue in Artifex Ghostscript allows attackers to execute code using the "pipe" instruction by supplying crafted PostScript, due to incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions. This could enable a remote attacker to load specially crafted PostScript code and, as a result, execute arbitrary code.

Recommendations For versions prior to 9.24, update to version 9.24 or later to resolve the issue. As a temporary workaround, consider restricting the use of the "pipe" instruction in crafted PostScript code until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALSA-2021_1852

ALT-PU-2018-2799

BDU:2019-00422

CESA-2018_2918

CESA-2018_3760

CVE-2018-16509

DLA-1504-1

DSA-4294-1

ELSA-2018-2918

ELSA-2018-3760

MGASA-2018-0378

OPENSUSE-SU-2018_3036-1

OPENSUSE-SU-2018_3038-1

OPENSUSE-SU-2024:10783-1

RHSA-2018:2918

RHSA-2018:3760

RHSA-2018_2918

RHSA-2018_3760

SUSE-SU-2018:2975-1

SUSE-SU-2018:2975-2

SUSE-SU-2018:2975-3

SUSE-SU-2018:2976-1

SUSE-SU-2018:3330-1

SUSE-SU-2018_2975-1

SUSE-SU-2018_2975-2

SUSE-SU-2018_2975-3

SUSE-SU-2018_2976-1

SUSE-SU-2018_3330-1

USN-3768-1

Affected Products

Alt Linux

Artifex Ghostscript

Centos

Red Hat

Suse

Ubuntu

References · 132

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/ghostscript_failed_restore.rb · Exploit
• 🔥 https://github.com/farisv/PIL-RCE-Ghostscript-CVE-2018-16509 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-16509 · Exploit
• 🔥 https://medium.com/@NumbShiva/imagemagic-rce-f364a9f50a14 · Exploit
• 🔥 https://exploit-db.com/exploits/45369 · Exploit
• 🔥 http://seclists.org/oss-sec/2018/q3/142 · Exploit
• https://ubuntu.com/security/CVE-2018-16802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15909 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10783-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16585 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16509 · Vendor Advisory
• https://debian.org/security/2018/dsa-4294 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3760 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16513 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16510 · Vendor Advisory