CVE-2018-16509: Critical severity debian linux vulnerability
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
Other sources
It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. A specially crafted PostScript document could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-16509?
CVE-2018-16509 is a vulnerability in Artifex Ghostscript before version 9.24 that allows attackers to execute code using the "pipe" instruction.
How severe is CVE-2018-16509?
CVE-2018-16509 has a severity rating of 7.8 out of 10, making it a critical vulnerability.
What software is affected by CVE-2018-16509?
CVE-2018-16509 affects Artifex Ghostscript versions before 9.24.
How can I fix CVE-2018-16509?
To fix CVE-2018-16509, update Artifex Ghostscript to version 9.24 or later.
Where can I find more information about CVE-2018-16509?
You can find more information about CVE-2018-16509 at the following references: [http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5516c614dc33662a2afdc377159f70218e67bde5](http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5516c614dc33662a2afdc377159f70218e67bde5), [http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=78911a01b67d590b4a91afac2e8417360b934156](http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=78911a01b67d590b4a91afac2e8417360b934156), [http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=79cccf641486a6595c43f1de1cd7ade696020a31](http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=79cccf641486a6595c43f1de1cd7ade696020a31)