CVE-2018-15910

HIGH 7.8CVE-2018-15910 · Published 27/08/2018 · updated 17/06/2026

In short

CVE-2018-15910 is a HIGH (CVSS 7.8) vulnerability affecting ghostscript (artifex), gpl ghostscript (artifex), pulse connect secure (pulsesecure).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.4% of all vulnerabilities.
Fix: update to 9.24, 9.26, 8.2r12.1, 8.3r7.1 or later.

Package	Affected versions	Patched versions
ghostscript artifex	`< 9.24`	`9.24`
gpl ghostscript artifex	`< 9.26`	`9.26`
pulse connect secure pulsesecure	`≥ 8.2r1.0, < 8.2r12.1≥ 8.3r1, < 8.3r7.1≥ 9.0r1, < 9.0r3.4`	`8.2r12.18.3r7.19.0r3.4`

Description

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.

References

git.ghostscript.com
securityfocus.com/bid/105122 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2918 · Third Party Advisory
bugs.ghostscript.com/show_bug.cgi · Permissions Required
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Patch
lists.debian.org/debian-lts-announce/2018/09/msg00015.html · Mailing List
security.gentoo.org/glsa/201811-12 · Third Party Advisory
support.f5.com/csp/article/K22141757
usn.ubuntu.com/3768-1 · Third Party Advisory
debian.org/security/2018/dsa-4288 · Third Party Advisory
kb.cert.org/vuls/id/332928 · Patch

More vulnerabilities in ghostscript

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ghostscript

artifex

< 9.24

9.24

gpl ghostscript

artifex

< 9.26

9.26

pulse connect secure

pulsesecure

≥ 8.2r1.0, < 8.2r12.1≥ 8.3r1, < 8.3r7.1≥ 9.0r1, < 9.0r3.4

8.2r12.18.3r7.19.0r3.4

More vulnerabilities in ghostscript

See all →