CVE-2018-16863: OS Command Injection
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
Other sources
It was found that the fix for CVE-2018-16509 provided in Red Hat Enterprise Linux 7 was not sufficient.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-16863?
CVE-2018-16863 is a vulnerability that allows an attacker to execute arbitrary shell commands via a specially crafted PostScript document in Ghostscript version 9.07.
How severe is CVE-2018-16863?
CVE-2018-16863 has a severity rating of 7.8 (Critical).
Which software versions are affected by CVE-2018-16863?
Ghostscript version 9.07 and Red Hat Enterprise Linux versions 7.0, 7.6, and 7.6 (Aus, Eus, Tus) are affected by CVE-2018-16863.
How can an attacker exploit CVE-2018-16863?
An attacker can exploit CVE-2018-16863 by exploiting another variant of a previously fixed flaw in RHSA-2018:2918 and bypassing the -dSAFER protection in order to execute arbitrary shell commands.
How can I fix CVE-2018-16863?
To fix CVE-2018-16863, it is recommended to update to a patched version of Ghostscript and Red Hat Enterprise Linux, as provided by the respective vendors.