CVE-2018-16585

Опубликовано: 06 сент. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)

Ссылки

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22
https://bugzilla.redhat.com/show_bug.cgi?id=1626193
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/182
Mailing List
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22
https://bugzilla.redhat.com/show_bug.cgi?id=1626193
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/182
Mailing List
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*

Версия до 9.24 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00496

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2018-16585

CVSS3: 7.8

ubuntu

больше 7 лет назад

CVE-2018-16585

CVSS3: 7

redhat

больше 7 лет назад

CVE-2018-16585

CVSS3: 7.8

debian

больше 7 лет назад

An issue was discovered in Artifex Ghostscript before 9.24. The .setdi ...

GHSA-4j37-xf23-h2px

CVSS3: 7.8

github

больше 3 лет назад

** DISPUTED ** An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193).

BDU:2020-01870

CVSS3: 7.8

fstec

больше 8 лет назад

Уязвимость реализации команды setdistillerkeys набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 65%

0.00496

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-119