CVE-2018-16539

Опубликовано: 05 сент. 2018

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.

Ссылки

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b
https://access.redhat.com/errata/RHSA-2018:3650
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=699658
Issue Tracking
Permissions Required
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.artifex.com/news/ghostscript-security-resolved/
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b
https://access.redhat.com/errata/RHSA-2018:3650
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=699658
Issue Tracking
Permissions Required
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.artifex.com/news/ghostscript-security-resolved/
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*

Версия до 9.24 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 57%

0.00352

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2018-16539

CVSS3: 5.5

ubuntu

около 7 лет назад

CVE-2018-16539

CVSS3: 5.3

redhat

около 7 лет назад

CVE-2018-16539

CVSS3: 5.5

debian

около 7 лет назад

In Artifex Ghostscript before 9.24, attackers able to supply crafted P ...

GHSA-prv5-j87r-4g4g

CVSS3: 5.5

github

больше 3 лет назад

ELSA-2018-3650

oracle-oval

почти 7 лет назад

ELSA-2018-3650: ghostscript security update (IMPORTANT)

EPSS

Процентиль: 57%

0.00352

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200