The version of Artifex Ghostscript installed on the remote Windows host is prior to 9.25. It is, therefore, affected by a code execution vulnerability.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ghostscript: /invalidaccess bypass after failed     restore.(CVE-2018-16509)

  - ghostscript: LockDistillerParams type     confusion.(CVE-2018-15910)

  - ghostscript: definemodifiedfont memory corruption if     /typecheck is handled.(CVE-2018-16542)

  - ghostscript: Stack-based out-of-bounds write in     pdf_set_text_matrix function in gdevpdts.c     (CVE-2018-10194)

  - ghostscript: incorrect free logic in pagedevice     replacement.(CVE-2018-16541)

  - ghostscript:se-after-free in copydevice     handling.(CVE-2018-16540)

  - ghostscript:gssetresolution and gsgetresolution memory     corruption.(CVE-2018-16543)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The set_text_distance function in     devices/vector/gdevpdts.c in the pdfwrite component in     Artifex Ghostscript through 9.22 does not prevent     overflows in text-positioning calculation, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PDF document.i1/4^CVE-2018-10194i1/4%0

  - It was discovered that the type of the     LockDistillerParams parameter is not properly verified.
    An attacker could possibly exploit this to bypass the
    -dSAFER protection and crash ghostscript or, possibly,     execute arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-15910i1/4%0

  - It was discovered that the ghostscript /invalidaccess     checks fail under certain conditions. An attacker could     possibly exploit this to bypass the -dSAFER protection     and, for example, execute arbitrary shell commands via     a specially crafted PostScript     document.i1/4^CVE-2018-16509i1/4%0

  - It was discovered that ghostscript did not properly     handle certain stack overflow error conditions. An     attacker could possibly exploit this to bypass the
    -dSAFER protection and crash ghostscript or, possibly,     execute arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-16542i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has ghostscript packages installed that are affected by a vulnerability:

  - It was discovered that the ghostscript /invalidaccess     checks fail under certain conditions. An attacker could     possibly exploit this to bypass the -dSAFER protection     and, for example, execute arbitrary shell commands via a     specially crafted PostScript document. (CVE-2018-16509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for ghostscript is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document.
(CVE-2018-16509)

Red Hat would like to thank Tavis Ormandy (Google Project Zero) for reporting this issue.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Artifex Ghostscript before 9.24. Incorrect restoration of privilege checking     during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript     to execute code using the pipe instruction. (CVE-2018-16509)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

  - CVE-2018-17183: Remote attackers were be able to supply     crafted PostScript to potentially overwrite or replace     error handlers to inject code (bsc#1109105)

  - CVE-2018-15909: Prevent type confusion using the .shfill     operator that could have been used by attackers able to     supply crafted PostScript files to crash the interpreter     or potentially execute code (bsc#1106172).

  - CVE-2018-15908: Prevent attackers that are able to     supply malicious PostScript files to bypass .tempfile     restrictions and write files (bsc#1106171).

  - CVE-2018-15910: Prevent a type confusion in the     LockDistillerParams parameter that could have been used     to crash the interpreter or execute code (bsc#1106173).

  - CVE-2018-15911: Prevent use uninitialized memory access     in the aesdecode operator that could have been used to     crash the interpreter or potentially execute code     (bsc#1106195).

  - CVE-2018-16513: Prevent a type confusion in the setcolor     function that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107412).

  - CVE-2018-16509: Incorrect 'restoration of privilege'     checking during handling of /invalidaccess exceptions     could be have been used by attackers able to supply     crafted PostScript to execute code using the 'pipe'     instruction (bsc#1107410).

  - CVE-2018-16510: Incorrect exec stack handling in the     'CS' and 'SC' PDF primitives could have been used by     remote attackers able to supply crafted PDFs to crash     the interpreter or possibly have unspecified other     impact (bsc#1107411).

  - CVE-2018-16542: Prevent attackers able to supply crafted     PostScript files from using insufficient interpreter     stack-size checking during error handling to crash the     interpreter (bsc#1107413).

  - CVE-2018-16541: Prevent attackers able to supply crafted     PostScript files from using incorrect free logic in     pagedevice replacement to crash the interpreter     (bsc#1107421).

  - CVE-2018-16540: Prevent use-after-free in copydevice     handling that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107420).

  - CVE-2018-16539: Prevent attackers able to supply crafted     PostScript files from using incorrect access checking in     temp file handling to disclose contents of files on the     system otherwise not readable (bsc#1107422).

  - CVE-2018-16543: gssetresolution and gsgetresolution     allowed attackers to have an unspecified impact     (bsc#1107423).

  - CVE-2018-16511: A type confusion in 'ztype' could have     been used by remote attackers able to supply crafted     PostScript to crash the interpreter or possibly have     unspecified other impact (bsc#1107426).

  - CVE-2018-16585: The .setdistillerkeys PostScript command     was accepted even though it is not intended for use     during document processing (e.g., after the startup     phase). This lead to memory corruption, allowing remote     attackers able to supply crafted PostScript to crash the     interpreter or possibly have unspecified other impact     (bsc#1107581).

  - CVE-2018-16802: Incorrect 'restoration of privilege'     checking when running out of stack during exception     handling could have been used by attackers able to     supply crafted PostScript to execute code using the     'pipe' instruction. This is due to an incomplete fix for     CVE-2018-16509 (bsc#1108027).

These non-security issues were fixed :

  - Fixes problems with argument handling, some unintended     results of the security fixes to the SAFER file access     restrictions (specifically accessing ICC profile files).

  - Avoid that ps2epsi fails with 'Error: /undefined in
    --setpagedevice--'

For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm and the changes file of the package. This update was imported from the SUSE:SLE-12:Update update project.

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105)

CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172).

CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171).

CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173).

CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195).

CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412).

CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the 'pipe' instruction (bsc#1107410).

CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411).

CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413).

CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421).

CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420).

CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422).

CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423).

CVE-2018-16511: A type confusion in 'ztype' could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426).

CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581).

CVE-2018-16802: Incorrect 'restoration of privilege' checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the 'pipe' instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - It was found that the fix for CVE-2018-16509 was not     complete, the missing pieces added into     ghostscript-CVE-2018-16509.patch

  - Resolves: #1641124 - CVE-2018-16509 ghostscript:
    /invalidaccess bypass after failed restore

  - Added security fix for CVE-2017-8291 (bug #1446063)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117596	Artifex Ghostscript < 9.25 PostScript Code Execution Vulnerability	Nessus	Windows	2018/9/19	2024/8/6	high
119919	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2018-1430)	Nessus	Huawei Local Security Checks	2018/12/28	2024/7/12	high
123862	EulerOS Virtualization 2.5.3 : ghostscript (EulerOS-SA-2019-1176)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	high
123901	EulerOS Virtualization 2.5.4 : ghostscript (EulerOS-SA-2019-1215)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	high
127412	NewStart CGSL MAIN 4.05 : ghostscript Vulnerability (NS-SA-2019-0145)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
144534	Virtuozzo 6 : ghostscript / ghostscript-devel / ghostscript-doc / etc (VZLSA-2018-3760)	Nessus	Virtuozzo Local Security Checks	2020/12/22	2024/1/31	high
222102	Linux Distros Unpatched Vulnerability : CVE-2018-16509	Nessus	Misc.	2025/3/4	2026/9/2	high
117979	openSUSE Security Update : ghostscript (openSUSE-2018-1122)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
118298	SUSE SLES12 Security Update : ghostscript (SUSE-SU-2018:2975-2)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	high
119484	OracleVM 3.3 / 3.4 : ghostscript (OVMSA-2018-0285)	Nessus	OracleVM Local Security Checks	2018/12/7	2022/5/27	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high