CVE-2018-16802: High severity Artifex Ghostscript vulnerability
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16802?
The severity of CVE-2018-16802 is high with a CVSS score of 7.8.
How can attackers exploit CVE-2018-16802?
Attackers can exploit CVE-2018-16802 by supplying crafted PostScript to execute code using the "pipe" instruction.
Which software versions are affected by CVE-2018-16802?
The affected software versions include Artifex Ghostscript before 9.25, and certain versions of Ubuntu, Debian, Canonical Ubuntu Linux, and Red Hat Enterprise Linux Server.
What is the remedy for CVE-2018-16802?
The remedy for CVE-2018-16802 is to update to Ghostscript version 9.25 or later.
Where can I find more information about CVE-2018-16802?
You can find more information about CVE-2018-16802 at the following references: [Reference 1](https://seclists.org/oss-sec/2018/q3/228), [Reference 2](http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3e5d316b72e3965b7968bb1d96baa137cd063ac6), [Reference 3](http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=643b24dbd002fb9c131313253c307cf3951b3d47).