Improper input validation in Ghostscript - CVE-2018-16541
Published: November 9, 2018 / Updated: November 9, 2018
Vulnerability identifier: #VU15785
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16541
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to insufficient validation of user-supplied input. A remote attacker can supply crafted PostScript files, use incorrect free logic in pagedevice replacement and crash the interpreter.
The weakness exists due to insufficient validation of user-supplied input. A remote attacker can supply crafted PostScript files, use incorrect free logic in pagedevice replacement and crash the interpreter.
Affected software
Ghostscript
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
How to mitigate CVE-2018-16541
Update to version 9.24.
Ghostscript - update to 9.24