CVE-2018-16863

Опубликовано: 03 дек. 2018

Источник: nvd

CVSS3: 7.3

CVSS3: 7.8

CVSS2: 9.3

EPSS Низкий

Описание

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.

Ссылки

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486
https://access.redhat.com/errata/RHSA-2018:3761
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
Issue Tracking
Patch
Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486
https://access.redhat.com/errata/RHSA-2018:3761
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:ghostscript:9.07:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 25%

0.00083

Низкий

7.3 High

CVSS3

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-184

CWE-78

Связанные уязвимости

CVE-2018-16863

CVSS3: 7.3

ubuntu

почти 7 лет назад

CVE-2018-16863

CVSS3: 7.3

redhat

почти 7 лет назад

CVE-2018-16863

CVSS3: 7.3

debian

почти 7 лет назад

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An ...

GHSA-83g5-f7jm-c8fc

CVSS3: 7.8

github

больше 3 лет назад

ELSA-2018-3761

oracle-oval

почти 7 лет назад

ELSA-2018-3761: ghostscript security and bug fix update (IMPORTANT)

EPSS

Процентиль: 25%

0.00083

Низкий

7.3 High

CVSS3

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-184

CWE-78