SB2018120409 - Red Hat update for Artifex Ghostscript 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018120409

SB2018120409 - Red Hat update for Artifex Ghostscript

Published: December 4, 2018

Security Bulletin ID SB2018120409
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) OS command injection (CVE-ID: CVE-2018-16509)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to /invalidaccess checks can be bypassed after a restore failure. A remote unauthenticated attacker can trick the victim into opening a specially crafted PostScript file that submits malicious input and execute arbitrary shell commands.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: original fix for this vulnerability was incomplete in version 9.24. Vendor has issued another patch.


Remediation

Install update from vendor's website.

References