Remote Code Injection Vulnerability in Ghostscript by Artifex
CVE-2018-17183

7.8HIGH

Key Information:

Vendor
Debian
Status
Debian Linux
Ubuntu Linux
Ghostscript
Vendor
CVE Published:
19 September 2018

Summary

Artifex Ghostscript versions prior to 9.25 have a significant vulnerability that allows remote attackers to exploit a user-writable error exception table. By submitting specially crafted PostScript files, malicious users could overwrite or replace existing error handlers. This vulnerability facilitates potential code injection, raising concerns for the integrity and security of systems utilizing Ghostscript.

References

https://usn.ubuntu.com/3773-1/
vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3834
vendor-advisoryx_refsource_REDHAT
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.