Every CVE Search/ Get API key

CVE-2018-11645

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is...

5.3 MediumFix available

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

2.58%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
CVE-2018-11645
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
CVE-2018-11645
Updated
2026-11-02
EUVDEUVD-2018-3668 No score

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
EUVD-2018-3668
Updated
2026-11-03
GitHub AdvisoriesGHSA-95h7-9j6q-g8q9 5.3

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is...

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
GHSA-95h7-9j6q-g8q9
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVBELL-CVE-2018-11645 5.3

CVE-2018-11645 does not affect BellSoft software

Record
BELL-CVE-2018-11645
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 5.3

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
CVE-2018-11645
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2018-11645 5.3

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
DEBIAN-CVE-2018-11645
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2019:2281 5.3

Red Hat Security Advisory: ghostscript security, bug fix, and enhancement update

Record
RHSA-2019:2281
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-11645 5.3

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

Record
UBUNTU-CVE-2018-11645
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUSN-3768-1 No score

ghostscript vulnerabilities

Tavis Ormandy discovered multiple security issues in Ghostscript. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use these issues to access arbitrary files, execute arbitrary code, or cause a denial of service.

Record
USN-3768-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Debian:12
 before 9.21~dfsg-1
9.21~dfsg-1
ghostscript
Debian:13
 before 9.21~dfsg-1
9.21~dfsg-1
ghostscript
Debian:14
 before 9.21~dfsg-1
9.21~dfsg-1
ghostscript
Debian:8
 before 9.06~dfsg-2+deb8u8, plus listed versions
9.06~dfsg-29.06~dfsg-2+deb8u19.06~dfsg-2+deb8u29.06~dfsg-2+deb8u39.06~dfsg-2+deb8u49.06~dfsg-2+deb8u59.06~dfsg-2+deb8u69.06~dfsg-2+deb8u7
9.06~dfsg-2+deb8u8
ghostscript
Debian:9
 before 9.25~dfsg-0+deb9u1, plus listed versions
9.20~dfsg-3.29.20~dfsg-3.2+deb9u19.20~dfsg-3.2+deb9u29.20~dfsg-3.2+deb9u39.20~dfsg-3.2+deb9u4
Show 10 moreShow less
9.20~dfsg-3.2+deb9u59.21~dfsg-19.21~dfsg-1~exp19.22~dfsg-19.22~dfsg-29.22~dfsg-2.19.22~dfsg-2~riscv649.22~dfsg-39.22~~rc1~dfsg-19.24~~rc2~dfsg-1
9.25~dfsg-0+deb9u1
ghostscript
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-cups
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
libgs
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-doc
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
Show 26 moreShow less
Affected packages
PackageAffectedFixed
ghostscript-gtk
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
libgs-devel
Red Hat:enterprise_linux:7::client
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-cups
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
libgs
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-doc
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-gtk
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
libgs-devel
Red Hat:enterprise_linux:7::computenode
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-cups
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
libgs
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-doc
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-gtk
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
libgs-devel
Red Hat:enterprise_linux:7::server
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-cups
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
libgs
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-doc
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript-gtk
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
libgs-devel
Red Hat:enterprise_linux:7::workstation
 before 0:9.25-2.el7
0:9.25-2.el7
ghostscript
Ubuntu:14.04:LTS
 before 9.10~dfsg-0ubuntu10.13, plus listed versions
9.10~dfsg-0ubuntu29.10~dfsg-0ubuntu39.10~dfsg-0ubuntu49.10~dfsg-0ubuntu59.10~dfsg-0ubuntu6
Show 14 moreShow less
9.10~dfsg-0ubuntu79.10~dfsg-0ubuntu89.10~dfsg-0ubuntu99.10~dfsg-0ubuntu109.10~dfsg-0ubuntu10.19.10~dfsg-0ubuntu10.29.10~dfsg-0ubuntu10.39.10~dfsg-0ubuntu10.49.10~dfsg-0ubuntu10.59.10~dfsg-0ubuntu10.69.10~dfsg-0ubuntu10.79.10~dfsg-0ubuntu10.99.10~dfsg-0ubuntu10.109.10~dfsg-0ubuntu10.12
9.10~dfsg-0ubuntu10.13
ghostscript
Ubuntu:16.04:LTS
 before 9.18~dfsg~0-0ubuntu2.9, plus listed versions
9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2
Show 5 moreShow less
9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.8
9.18~dfsg~0-0ubuntu2.9
ghostscript
Ubuntu:18.04:LTS
 before 9.22~dfsg+1-0ubuntu1.2, plus listed versions
9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.1
9.22~dfsg+1-0ubuntu1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11645 is a medium vulnerability (CVSS 5.3) in Artifex Ghostscript, published June 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in ghostscript 9.21~dfsg-1.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open