CVE-2018-16539

Опубликовано: 05 сент. 2018

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.

Ссылки

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b
https://access.redhat.com/errata/RHSA-2018:3650
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=699658
Issue Tracking
Permissions Required
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.artifex.com/news/ghostscript-security-resolved/
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b
https://access.redhat.com/errata/RHSA-2018:3650
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=699658
Issue Tracking
Permissions Required
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.artifex.com/news/ghostscript-security-resolved/
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*

Версия до 9.24 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.01445

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2018-16539

CVSS3: 5.5

ubuntu

почти 8 лет назад

CVE-2018-16539

CVSS3: 5.3

redhat

почти 8 лет назад

CVE-2018-16539

CVSS3: 5.5

debian

почти 8 лет назад

In Artifex Ghostscript before 9.24, attackers able to supply crafted P ...

GHSA-prv5-j87r-4g4g

CVSS3: 5.5

github

около 4 лет назад

ELSA-2018-3650

oracle-oval

больше 7 лет назад

ELSA-2018-3650: ghostscript security update (IMPORTANT)

EPSS

Процентиль: 70%

0.01445

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200