CVE-2018-16541

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.

Published: Sep 5, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-16541
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-416

Affected Software
References

Software	From	Fixed in
artifex / ghostscript	-	9.24
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	18.04	18.04.x
debian / debian_linux	8.0	8.0.x
debian / debian_linux	9.0	9.0.x
redhat / enterprise_linux_desktop	7.0	7.0.x
redhat / enterprise_linux_workstation	7.0	7.0.x
redhat / enterprise_linux_server	7.0	7.0.x
redhat / enterprise_linux_server_tus	7.6	7.6.x
redhat / enterprise_linux_server_eus	7.6	7.6.x
redhat / enterprise_linux_server_aus	7.6	7.6.x

http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=241d91112771a6104de10b3948c3f350d6690c1d
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=241d91112771a6104de10b3948c3f350d6690c1d
https://access.redhat.com/errata/RHSA-2018:3834
https://bugs.ghostscript.com/show_bug.cgi?id=699664
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
https://security.gentoo.org/glsa/201811-12
https://usn.ubuntu.com/3768-1/
https://www.artifex.com/news/ghostscript-security-resolved/
https://www.debian.org/security/2018/dsa-4288

Vulnerability Database

CVE-2018-16541