Skip to main content

Ghostscript CVE-2018-18284

HIGH
2018-10-19 cve@mitre.org
8.6
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.6 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 19, 2018 - 22:29 nvd
HIGH 8.6

DescriptionNVD

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.

AnalysisAI

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Affected products include: Artifex Ghostscript, Debian Debian Linux, Canonical Ubuntu Linux, Artifex Gpl Ghostscript, Redhat Enterprise Linux Desktop.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2016-7976 HIGH POC
8.8 Aug 07

The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams

CVE-2018-16509 HIGH POC
7.8 Sep 05

An issue was discovered in Artifex Ghostscript before 9.24. Rated high severity (CVSS 7.8), this vulnerability is no aut

CVE-2012-4405 MEDIUM
6.8 Sep 18

Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl

CVE-2023-28879 CRITICAL POC
9.8 Mar 31

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to t

CVE-2018-17961 HIGH POC
8.6 Oct 15

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving err

CVE-2016-10317 HIGH POC
7.8 Apr 03

The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Rated high severity (CVSS 7.8), this

CVE-2017-9611 HIGH POC
7.8 Jul 26

The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial

CVE-2017-9835 HIGH POC
7.8 Jul 26

The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of

CVE-2017-7948 HIGH POC
7.8 Apr 19

Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of ser

CVE-2020-16303 HIGH POC
7.8 Aug 13

A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9

CVE-2019-14817 HIGH POC
7.8 Sep 03

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not prop

CVE-2019-14811 HIGH POC
7.8 Sep 03

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properl

Share

CVE-2018-18284 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy