PT-2018-2555 · Artifex+3 · Ghostscript+3

Tavis Ormandy · Published 2018-08-21 · Updated 2024-06-15 · CVE-2018-16513

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24

Description The issue is related to a type confusion in the setcolor function, which can be exploited by supplying crafted PostScript files. This could potentially allow attackers to crash the interpreter or have other unspecified impacts. The vulnerability may also allow a remote attacker to affect the confidentiality, integrity, and availability of protected information using a specially crafted PostScript file.

Recommendations For versions prior to 9.24, update to version 9.24 or later to resolve the issue. As a temporary workaround, consider restricting the use of the setcolor function until a patch is available. Avoid using crafted PostScript files that could exploit the type confusion in the setcolor function.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

ALT-PU-2018-2799

BDU:2019-00973

CVE-2018-16513

DLA-1504-1

DSA-4288-1

MGASA-2018-0378

OPENSUSE-SU-2018_3036-1

OPENSUSE-SU-2018_3038-1

OPENSUSE-SU-2024:10783-1

SUSE-SU-2018:2975-1

SUSE-SU-2018:2975-2

SUSE-SU-2018:2975-3

SUSE-SU-2018:2976-1

SUSE-SU-2018:3330-1

USN-3768-1

Affected Products

Alt Linux

Ghostscript

Suse

Ubuntu

References · 119

• https://ubuntu.com/security/CVE-2018-16542 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00973 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2976-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16510 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2975-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11645 · Vendor Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=699655 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16513 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16539 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16509 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16511 · Vendor Advisory
• https://debian.org/security/2018/dsa-4288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16513 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0378 · Vendor Advisory