QwikSec

Security Database

CVE

CWE

Training

CVE-2018-16585

Published: Sep 6, 2018

Modified: Nov 14, 2024

PUBLISHED

Description

An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_GENTOO

vendor-advisory

x_refsource_UBUNTU

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be

x_refsource_MISC

vendor-advisory

x_refsource_DEBIAN

[debian-lts-announce] 20180913 [SECURITY] [DLA 1504-1] ghostscript security update

mailing-list

x_refsource_MLIST

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22

x_refsource_MISC

https://seclists.org/oss-sec/2018/q3/182

x_refsource_MISC

https://bugzilla.redhat.com/show_bug.cgi?id=1626193

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.