CVE-2018-15909

高危 7.8CVE-2018-15909 · Published 27/08/2018 · updated 17/06/2026

要点

CVE-2018-15909 是影响 ghostscript (artifex), gpl ghostscript (artifex), pulse connect secure (pulsesecure) 的高危 (CVSS 7.8)漏洞。
未来 30 天内被利用的概率（EPSS）：3.0%，高于 87.3% 的漏洞。
修复：升级到 9.26, 8.2r12.1, 8.3r7.1, 9.0r3.4 或更高版本。

Package	Affected versions	Patched versions
ghostscript artifex	`≤ 9.23`	No fix yet
gpl ghostscript artifex	`< 9.26`	`9.26`
pulse connect secure pulsesecure	`≥ 8.2r1.0, < 8.2r12.1≥ 8.3r1, < 8.3r7.1≥ 9.0r1, < 9.0r3.4`	`8.2r12.18.3r7.19.0r3.4`

Description

In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.

References

git.ghostscript.com
git.ghostscript.com
securityfocus.com/bid/105178 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:3650 · Third Party Advisory
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 · Patch
lists.debian.org/debian-lts-announce/2018/09/msg00015.html · Mailing List
security.gentoo.org/glsa/201811-12 · Third Party Advisory
support.f5.com/csp/article/K24803507
usn.ubuntu.com/3768-1 · Third Party Advisory
kb.cert.org/vuls/id/332928 · Patch

ghostscript 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ghostscript

artifex

≤ 9.23

No fix yet

gpl ghostscript

artifex

< 9.26

9.26

pulse connect secure

pulsesecure

≥ 8.2r1.0, < 8.2r12.1≥ 8.3r1, < 8.3r7.1≥ 9.0r1, < 9.0r3.4

8.2r12.18.3r7.19.0r3.4

ghostscript 的其他漏洞

查看全部 →