REDHAT-BUG-1626193
First published: Thu Sep 06 2018(Updated: )
An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. References: <a href="http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=1497d65039885a52b598b137dd8622bd4672f9be">http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=1497d65039885a52b598b137dd8622bd4672f9be</a> <a href="http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=971472c83a345a16dac9f90f91258bb22dd77f22">http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=971472c83a345a16dac9f90f91258bb22dd77f22</a> <a href="https://seclists.org/oss-sec/2018/q3/182">https://seclists.org/oss-sec/2018/q3/182</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ghostscript | <9.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=1497d65039885a52b598b137dd8622bd4672f9be
- http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=971472c83a345a16dac9f90f91258bb22dd77f22
- https://seclists.org/oss-sec/2018/q3/182
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1626194
- http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b0a385475
- https://access.redhat.com/security/cve/CVE-2018-15910
- https://bugzilla.redhat.com/show_bug.cgi?id=1626193
Frequently Asked Questions
What is the severity of REDHAT-BUG-1626193?
The severity of REDHAT-BUG-1626193 is considered critical due to its potential to cause memory corruption.
How do I fix REDHAT-BUG-1626193?
To fix REDHAT-BUG-1626193, upgrade to the latest version of Artifex Ghostscript that is higher than 9.24.
Who is affected by REDHAT-BUG-1626193?
Users of Artifex Ghostscript versions prior to 9.24 are affected by REDHAT-BUG-1626193.
What kind of attacks are possible with REDHAT-BUG-1626193?
REDHAT-BUG-1626193 allows remote attackers to exploit crafted PostScript files, potentially leading to arbitrary code execution.
Is there a workaround for REDHAT-BUG-1626193?
There is no specific workaround for REDHAT-BUG-1626193; upgrading to a secure version is recommended.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-16585
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/artifex
- canonical/ghostscript