CVE-2018-16509

HIGH 7.8CVE-2018-16509 · Published 05/09/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
ghostscript artifex	`< 9.24`	`9.24`
gpl ghostscript artifex	`< 9.26`	`9.26`

Description

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

References

git.ghostscript.com
git.ghostscript.com
git.ghostscript.com
git.ghostscript.com
seclists.org/oss-sec/2018/q3/142 · Exploit
securityfocus.com/bid/105122 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2918 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:3760 · Third Party Advisory
bugs.ghostscript.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2018/09/msg00015.html · Mailing List
security.gentoo.org/glsa/201811-12 · Third Party Advisory
usn.ubuntu.com/3768-1 · Third Party Advisory
artifex.com/news/ghostscript-security-resolved · Vendor Advisory
debian.org/security/2018/dsa-4294 · Third Party Advisory
exploit-db.com/exploits/45369 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free