CVE-2018-16802

Опубликовано: 10 сент. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.

Ссылки

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3e5d316b72e3965b7968bb1d96baa137cd063ac6
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=643b24dbd002fb9c131313253c307cf3951b3d47
https://access.redhat.com/errata/RHSA-2018:3834
Third Party Advisory
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5812b1b78fc4d36fdc293b7859de69241140d590
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/228
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/229
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4294
Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3e5d316b72e3965b7968bb1d96baa137cd063ac6
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=643b24dbd002fb9c131313253c307cf3951b3d47
https://access.redhat.com/errata/RHSA-2018:3834
Third Party Advisory
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5812b1b78fc4d36fdc293b7859de69241140d590
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/228
Mailing List
Third Party Advisory
https://seclists.org/oss-sec/2018/q3/229
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4294
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*

Версия до 9.25 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00971

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2018-16802

CVSS3: 7.8

ubuntu

около 7 лет назад

CVE-2018-16802

CVSS3: 7.3

redhat

около 7 лет назад

CVE-2018-16802

CVSS3: 7.8

debian

около 7 лет назад

An issue was discovered in Artifex Ghostscript before 9.25. Incorrect ...

GHSA-r3qx-w5mm-cr27

CVSS3: 7.8

github

больше 3 лет назад

BDU:2019-04351

CVSS3: 7.8

fstec

около 7 лет назад

Уязвимость набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 76%

0.00971

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo