CVE-2018-16802
ghostscript: An issue was discovered in Artifex Ghostscript before 9.25
CVE-2018-16802 is fixed in 4 products on 1 platform, first by ghostscript 9.22~dfsg+1-0ubuntu1.2, released September 9, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0209
81st percentile
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ghostscript · Ubuntu 18.04.6 LTS (bionic) | 9.22~dfsg+1-0ubuntu1.2 | ghostscript 9.22~dfsg+1-0ubuntu1.2 | Sep 9, 2018 |
| ghostscript-x · Ubuntu 18.04.6 LTS (bionic) | 9.22~dfsg+1-0ubuntu1.2 | ghostscript-x 9.22~dfsg+1-0ubuntu1.2 | Sep 9, 2018 |
| libgs9 · Ubuntu 18.04.6 LTS (bionic) | 9.22~dfsg+1-0ubuntu1.2 | libgs9 9.22~dfsg+1-0ubuntu1.2 | Sep 9, 2018 |
| libgs9-common · Ubuntu 18.04.6 LTS (bionic) | 9.22~dfsg+1-0ubuntu1.2 | libgs9-common 9.22~dfsg+1-0ubuntu1.2 | Sep 9, 2018 |