{"id":"CVE-2018-16539","aliases":["BELL-CVE-2018-16539","DEBIAN-CVE-2018-16539","DLA-1504-1","DSA-4288-1","EUVD-2018-8348","GHSA-prv5-j87r-4g4g","MGASA-2018-0378","RHSA-2018:3650","SUSE-SU-2018:2975-1","SUSE-SU-2018:2975-2","SUSE-SU-2018:2975-3","SUSE-SU-2018:2976-1","UBUNTU-CVE-2018-16539","USN-3768-1","openSUSE-SU-2024:10783-1"],"status":"published","title":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use...","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01445,"percentile":0.73445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-09-05T00:00:00Z","modified":"2026-10-23T18:03:00Z","fixes":[{"ecosystem":"Debian:12","package":"ghostscript","fixed_in":["9.22~dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["9.22~dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["9.22~dfsg-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","fixed_in":["9.10~dfsg-0ubuntu10.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ghostscript","fixed_in":["9.18~dfsg~0-0ubuntu2.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","fixed_in":["9.22~dfsg+1-0ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22~dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22~dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22~dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.06~dfsg-2+deb8u8"}]}],"versions":["9.06~dfsg-2","9.06~dfsg-2+deb8u1","9.06~dfsg-2+deb8u2","9.06~dfsg-2+deb8u3","9.06~dfsg-2+deb8u4","9.06~dfsg-2+deb8u5","9.06~dfsg-2+deb8u6","9.06~dfsg-2+deb8u7"],"bundled":14},{"source":"osv","ecosystem":"Debian:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20~dfsg-3.2+deb9u4"}]}],"versions":["9.20~dfsg-3.2","9.20~dfsg-3.2+deb9u1","9.20~dfsg-3.2+deb9u2","9.20~dfsg-3.2+deb9u3"],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.24-1.5.mga6"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.07-31.el7_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-23.13.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-3.6.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libspectre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8-3.2.1"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10~dfsg-0ubuntu10.13"}]}],"versions":["9.10~dfsg-0ubuntu2","9.10~dfsg-0ubuntu3","9.10~dfsg-0ubuntu4","9.10~dfsg-0ubuntu5","9.10~dfsg-0ubuntu6","9.10~dfsg-0ubuntu7","9.10~dfsg-0ubuntu8","9.10~dfsg-0ubuntu9","9.10~dfsg-0ubuntu10","9.10~dfsg-0ubuntu10.1","9.10~dfsg-0ubuntu10.2","9.10~dfsg-0ubuntu10.3","9.10~dfsg-0ubuntu10.4","9.10~dfsg-0ubuntu10.5","9.10~dfsg-0ubuntu10.6","9.10~dfsg-0ubuntu10.7","9.10~dfsg-0ubuntu10.9","9.10~dfsg-0ubuntu10.10","9.10~dfsg-0ubuntu10.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18~dfsg~0-0ubuntu2.9"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22~dfsg+1-0ubuntu1.2"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10~dfsg-0ubuntu10.13"}]}],"versions":["9.10~dfsg-0ubuntu2","9.10~dfsg-0ubuntu3","9.10~dfsg-0ubuntu4","9.10~dfsg-0ubuntu5","9.10~dfsg-0ubuntu6","9.10~dfsg-0ubuntu7","9.10~dfsg-0ubuntu8","9.10~dfsg-0ubuntu9","9.10~dfsg-0ubuntu10","9.10~dfsg-0ubuntu10.1","9.10~dfsg-0ubuntu10.2","9.10~dfsg-0ubuntu10.3","9.10~dfsg-0ubuntu10.4","9.10~dfsg-0ubuntu10.5","9.10~dfsg-0ubuntu10.6","9.10~dfsg-0ubuntu10.7","9.10~dfsg-0ubuntu10.9","9.10~dfsg-0ubuntu10.10","9.10~dfsg-0ubuntu10.12"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18~dfsg~0-0ubuntu2.9"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22~dfsg+1-0ubuntu1.2"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1"],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-2.2"}]}],"bundled":44}],"products":[{"vendor":"artifex","product":"ghostscript"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:3650","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201811-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3768-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.artifex.com/news/ghostscript-security-resolved/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://www.debian.org/security/2018/dsa-4288","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=699658","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16539","tags":["advisory"]},{"url":"http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=a054156d425b4dbdaaa9fda4b5f1182b27598c2b"},{"url":"https://github.com/advisories/GHSA-prv5-j87r-4g4g"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-16539","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16539","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0378.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23526","tags":["report"]},{"url":"https://www.ghostscript.com/doc/9.24/History9.htm#Version9.24","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/09/05/3","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/09/06/3","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/09/09/1","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/09/09/2","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/09/11/1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1621359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1621361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625839","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3650.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-15908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15908","tags":["advisory"]},{"url":"http://seclists.org/oss-sec/2018/q3/142","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-15909","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16511","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16539","tags":["advisory","report"]},{"url":"https://www.kb.cert.org/vuls/id/332928","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1106171","tags":["report"]},{"url":"https://bugzilla.suse.com/1106172","tags":["report"]},{"url":"https://bugzilla.suse.com/1106173","tags":["report"]},{"url":"https://bugzilla.suse.com/1106195","tags":["report"]},{"url":"https://bugzilla.suse.com/1107410","tags":["report"]},{"url":"https://bugzilla.suse.com/1107411","tags":["report"]},{"url":"https://bugzilla.suse.com/1107412","tags":["report"]},{"url":"https://bugzilla.suse.com/1107413","tags":["report"]},{"url":"https://bugzilla.suse.com/1107420","tags":["report"]},{"url":"https://bugzilla.suse.com/1107421","tags":["report"]},{"url":"https://bugzilla.suse.com/1107422","tags":["report"]},{"url":"https://bugzilla.suse.com/1107423","tags":["report"]},{"url":"https://bugzilla.suse.com/1107426","tags":["report"]},{"url":"https://bugzilla.suse.com/1107581","tags":["report"]},{"url":"https://bugzilla.suse.com/1108027","tags":["report"]},{"url":"https://bugzilla.suse.com/1109105","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17183","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182975-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182975-3/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182976-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16539","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3768-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-11645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16802","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3781","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16539","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T18:00:00Z","modified":"2024-08-05T10:24:32.975Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-8348","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T18:00:00Z","modified":"2024-08-05T10:24:32Z","updated_at":"2026-11-03T02:39:41.299131Z"}],"ghsa":[{"id":"GHSA-prv5-j87r-4g4g","title":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use...","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2022-05-14T01:28:06Z","modified":"2023-02-02T05:03:51Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:44.264716Z"}],"nvd":[{"id":"CVE-2018-16539","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T18:29:00.497Z","modified":"2026-06-17T01:44:26.96Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"BELL-CVE-2018-16539","title":"CVE-2018-16539 does not affect BellSoft software","status":"withdrawn","published":"2018-09-05T18:29:00Z","modified":"2026-01-26T09:47:46.576713Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-16539","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T18:29:00.497Z","modified":"2026-04-16T06:19:24.037893668Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16539","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T18:29:00.497Z","modified":"2026-10-23T18:03:00.76347997Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2018:3650","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2024-09-16T01:52:03Z","modified":"2026-06-26T10:39:58Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-16539","description":"In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.","status":"published","published":"2018-09-05T00:00:00Z","modified":"2026-04-22T11:47:38.454355Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1504-1","title":"ghostscript - security update","status":"published","published":"2018-09-13T00:00:00Z","modified":"2026-03-09T01:01:57.46722Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4288-1","title":"ghostscript - security update","status":"published","published":"2018-09-07T00:00:00Z","modified":"2026-03-09T02:08:50.141759Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0378","title":"Updated ghostscript packages fix security vulnerabilities","description":"Updated ghostscript packages fix several security vulnerabilities\nincluding:\n\nIn Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply\nmalicious PostScript files to bypass .tempfile restrictions and write files\n(CVE-2018-15908).\n\nIn Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the\n.shfill operator could be used by attackers able to supply crafted PostScript\nfiles to crash the interpreter or potentially execute code (CVE-2018-15909).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files could use a type confusion in the LockDistillerParams\nparameter to crash the interpreter or execute code (CVE-2018-15910).\n\nIn Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply\ncrafted PostScript could use uninitialized memory access in the aesdecode\noperator to crash the interpreter or potentially execute code\n(CVE-2018-15911).\n\nAn issue was discovered in Artifex Ghostscript before 9.24. Incorrect \n\"restoration of privilege\" checking during handling of /invalidaccess\nexceptions could be used by attackers able to supply crafted PostScript\nto execute code using the \"pipe\" instruction (CVE-2018-16509).\n\nAn issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec\nstack handling in the \"CS\" and \"SC\" PDF primitives could be used by remote\nattackers able to supply crafted PDFs to crash the interpreter or possibly\nhave unspecified other impact (CVE-2018-16510).\n\nAn issue was discovered in Artifex Ghostscript before 9.24. A type\nconfusion in \"ztype\" could be used by remote attackers able to supply\ncrafted PostScript to crash the interpreter or possibly have unspecified\nother impact (CVE-2018-16511).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files could use a type confusion in the setcolor function to\ncrash the interpreter or possibly have unspecified other impact\n(CVE-2018-16513).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files could use incorrect access checking in temp file handling\nto disclose contents of files on the system otherwise not readable\n(CVE-2018-16539).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files to the builtin PDF14 converter could use a use-after-free\nin copydevice handling to crash the interpreter or possibly have unspecified\nother impact (CVE-2018-16540).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files could use incorrect free logic in pagedevice replacement\nto crash the interpreter (CVE-2018-16541).\n\nIn Artifex Ghostscript before 9.24, attackers able to supply crafted\nPostScript files could use insufficient interpreter stack-size checking\nduring error handling to crash the interpreter (CVE-2018-16542).\n\nIn Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution\nallow attackers to have an unspecified impact (CVE-2018-16543).\n\nAn issue was discovered in Artifex Ghostscript before 9.25. Incorrect\n\"restoration of privilege\" checking when running out of stack during\nexception handling could be used by attackers able to supply crafted\nPostScript to execute code using the \"pipe\" instruction. This is due to\nan incomplete fix for CVE-2018-16509 (CVE-2018-16802).\n\nGS Bug 699663 : .setdistillerkeys memory corruption. (CVE Requested)\n\nGS Bug 699699 : Crash upon bogus input argument\n\nGS Bug 699719: Fix @ files in arg handling\n\nGS Bug 699711: Review arg_next to ensure that NULL arg returns are coped with\n\nGS Bug Fix SEGV seen in all-devices test with plank examples/ridt91.eps\n\nGS Bug 699708 (part 1): 'Hide' non-replaceable error handlers for SAFER\n\nGS Bug 699707: Security review bug - continuation procedures\n","status":"published","published":"2018-09-20T23:17:55Z","modified":"2026-04-16T06:24:13.755734699Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10783-1","title":"ghostscript-9.54.0-2.2 on GA media","description":"These are all security issues fixed in the ghostscript-9.54.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:19.404781Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:2975-1","title":"Security update for ghostscript","description":"This update for ghostscript to version 9.25 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to\n  potentially overwrite or replace error handlers to inject code (bsc#1109105)\n- CVE-2018-15909: Prevent type confusion using the .shfill operator that could\n  have been used by attackers able to supply crafted PostScript files to crash\n  the interpreter or potentially execute code (bsc#1106172).\n- CVE-2018-15908: Prevent attackers that are able to supply malicious\n  PostScript files to bypass .tempfile restrictions and write files\n  (bsc#1106171).\n- CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter\n  that could have been used to crash the interpreter or execute code\n  (bsc#1106173).\n- CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode\n  operator that could have been used to crash the interpreter or potentially\n  execute code (bsc#1106195).\n- CVE-2018-16513: Prevent a type confusion in the setcolor function that could\n  have been used to crash the interpreter or possibly have unspecified other\n  impact (bsc#1107412).\n- CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling\n  of /invalidaccess exceptions could be have been used by attackers able to\n  supply crafted PostScript to execute code using the 'pipe' instruction\n  (bsc#1107410).\n- CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF\n  primitives could have been used by remote attackers able to supply crafted PDFs\n  to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107411).\n- CVE-2018-16542: Prevent attackers able to supply crafted PostScript files\n  from using insufficient interpreter stack-size checking during error handling\n  to crash the interpreter (bsc#1107413).\n- CVE-2018-16541: Prevent attackers able to supply crafted PostScript files\n  from using incorrect free logic in pagedevice replacement to crash the\n  interpreter (bsc#1107421).\n- CVE-2018-16540: Prevent use-after-free in copydevice handling that could have\n  been used to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107420).\n- CVE-2018-16539: Prevent attackers able to supply crafted PostScript files\n  from using incorrect access checking in temp file handling to disclose contents\n  of files on the system otherwise not readable (bsc#1107422).\n- CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have\n  an unspecified impact (bsc#1107423).\n- CVE-2018-16511: A type confusion in 'ztype' could have been used by remote\n  attackers able to supply crafted PostScript to crash the interpreter or\n  possibly have unspecified other impact (bsc#1107426).\n- CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even\n  though it is not intended for use during document processing (e.g., after the\n  startup phase). This lead to memory corruption, allowing remote attackers able\n  to supply crafted PostScript to crash the interpreter or possibly have\n  unspecified other impact (bsc#1107581).\n- CVE-2018-16802: Incorrect 'restoration of privilege' checking when running\n  out of stack during exception handling could have been used by attackers able\n  to supply crafted PostScript to execute code using the 'pipe' instruction. This\n  is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).\n\nThese non-security issues were fixed:\n\n* Fixes problems with argument handling, some unintended results of the\n  security fixes to the SAFER file access restrictions (specifically accessing\n  ICC profile files).\n* Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--'\n\nFor additional changes please check http://www.ghostscript.com/doc/9.25/News.htm\nand the changes file of the package.\n  ","status":"published","published":"2018-10-02T14:51:05Z","modified":"2025-05-02T04:07:52.792771Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2975-2","title":"Security update for ghostscript","description":"This update for ghostscript to version 9.25 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to\n  potentially overwrite or replace error handlers to inject code (bsc#1109105)\n- CVE-2018-15909: Prevent type confusion using the .shfill operator that could\n  have been used by attackers able to supply crafted PostScript files to crash\n  the interpreter or potentially execute code (bsc#1106172).\n- CVE-2018-15908: Prevent attackers that are able to supply malicious\n  PostScript files to bypass .tempfile restrictions and write files\n  (bsc#1106171).\n- CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter\n  that could have been used to crash the interpreter or execute code\n  (bsc#1106173).\n- CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode\n  operator that could have been used to crash the interpreter or potentially\n  execute code (bsc#1106195).\n- CVE-2018-16513: Prevent a type confusion in the setcolor function that could\n  have been used to crash the interpreter or possibly have unspecified other\n  impact (bsc#1107412).\n- CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling\n  of /invalidaccess exceptions could be have been used by attackers able to\n  supply crafted PostScript to execute code using the 'pipe' instruction\n  (bsc#1107410).\n- CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF\n  primitives could have been used by remote attackers able to supply crafted PDFs\n  to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107411).\n- CVE-2018-16542: Prevent attackers able to supply crafted PostScript files\n  from using insufficient interpreter stack-size checking during error handling\n  to crash the interpreter (bsc#1107413).\n- CVE-2018-16541: Prevent attackers able to supply crafted PostScript files\n  from using incorrect free logic in pagedevice replacement to crash the\n  interpreter (bsc#1107421).\n- CVE-2018-16540: Prevent use-after-free in copydevice handling that could have\n  been used to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107420).\n- CVE-2018-16539: Prevent attackers able to supply crafted PostScript files\n  from using incorrect access checking in temp file handling to disclose contents\n  of files on the system otherwise not readable (bsc#1107422).\n- CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have\n  an unspecified impact (bsc#1107423).\n- CVE-2018-16511: A type confusion in 'ztype' could have been used by remote\n  attackers able to supply crafted PostScript to crash the interpreter or\n  possibly have unspecified other impact (bsc#1107426).\n- CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even\n  though it is not intended for use during document processing (e.g., after the\n  startup phase). This lead to memory corruption, allowing remote attackers able\n  to supply crafted PostScript to crash the interpreter or possibly have\n  unspecified other impact (bsc#1107581).\n- CVE-2018-16802: Incorrect 'restoration of privilege' checking when running\n  out of stack during exception handling could have been used by attackers able\n  to supply crafted PostScript to execute code using the 'pipe' instruction. This\n  is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).\n\nThese non-security issues were fixed:\n\n* Fixes problems with argument handling, some unintended results of the\n  security fixes to the SAFER file access restrictions (specifically accessing\n  ICC profile files).\n* Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--'\n\nFor additional changes please check http://www.ghostscript.com/doc/9.25/News.htm\nand the changes file of the package.\n  ","status":"published","published":"2018-10-18T12:51:24Z","modified":"2026-02-04T02:15:36.685509Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2975-3","title":"Security update for ghostscript","description":"This update for ghostscript to version 9.25 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to\n  potentially overwrite or replace error handlers to inject code (bsc#1109105)\n- CVE-2018-15909: Prevent type confusion using the .shfill operator that could\n  have been used by attackers able to supply crafted PostScript files to crash\n  the interpreter or potentially execute code (bsc#1106172).\n- CVE-2018-15908: Prevent attackers that are able to supply malicious\n  PostScript files to bypass .tempfile restrictions and write files\n  (bsc#1106171).\n- CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter\n  that could have been used to crash the interpreter or execute code\n  (bsc#1106173).\n- CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode\n  operator that could have been used to crash the interpreter or potentially\n  execute code (bsc#1106195).\n- CVE-2018-16513: Prevent a type confusion in the setcolor function that could\n  have been used to crash the interpreter or possibly have unspecified other\n  impact (bsc#1107412).\n- CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling\n  of /invalidaccess exceptions could be have been used by attackers able to\n  supply crafted PostScript to execute code using the 'pipe' instruction\n  (bsc#1107410).\n- CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF\n  primitives could have been used by remote attackers able to supply crafted PDFs\n  to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107411).\n- CVE-2018-16542: Prevent attackers able to supply crafted PostScript files\n  from using insufficient interpreter stack-size checking during error handling\n  to crash the interpreter (bsc#1107413).\n- CVE-2018-16541: Prevent attackers able to supply crafted PostScript files\n  from using incorrect free logic in pagedevice replacement to crash the\n  interpreter (bsc#1107421).\n- CVE-2018-16540: Prevent use-after-free in copydevice handling that could have\n  been used to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107420).\n- CVE-2018-16539: Prevent attackers able to supply crafted PostScript files\n  from using incorrect access checking in temp file handling to disclose contents\n  of files on the system otherwise not readable (bsc#1107422).\n- CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have\n  an unspecified impact (bsc#1107423).\n- CVE-2018-16511: A type confusion in 'ztype' could have been used by remote\n  attackers able to supply crafted PostScript to crash the interpreter or\n  possibly have unspecified other impact (bsc#1107426).\n- CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even\n  though it is not intended for use during document processing (e.g., after the\n  startup phase). This lead to memory corruption, allowing remote attackers able\n  to supply crafted PostScript to crash the interpreter or possibly have\n  unspecified other impact (bsc#1107581).\n- CVE-2018-16802: Incorrect 'restoration of privilege' checking when running\n  out of stack during exception handling could have been used by attackers able\n  to supply crafted PostScript to execute code using the 'pipe' instruction. This\n  is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).\n\nThese non-security issues were fixed:\n\n* Fixes problems with argument handling, some unintended results of the\n  security fixes to the SAFER file access restrictions (specifically accessing\n  ICC profile files).\n* Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--'\n\nFor additional changes please check http://www.ghostscript.com/doc/9.25/News.htm\nand the changes file of the package.\n  ","status":"published","published":"2019-04-27T15:19:13Z","modified":"2026-02-04T03:43:50.346559Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2976-1","title":"Security update for ghostscript","description":"This update for ghostscript to version 9.25 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to\n  potentially overwrite or replace error handlers to inject code (bsc#1109105)\n- CVE-2018-15909: Prevent type confusion using the .shfill operator that could\n  have been used by attackers able to supply crafted PostScript files to crash\n  the interpreter or potentially execute code (bsc#1106172).\n- CVE-2018-15908: Prevent attackers that are able to supply malicious\n  PostScript files to bypass .tempfile restrictions and write files\n  (bsc#1106171).\n- CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter\n  that could have been used to crash the interpreter or execute code\n  (bsc#1106173).\n- CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode\n  operator that could have been used to crash the interpreter or potentially\n  execute code (bsc#1106195).\n- CVE-2018-16513: Prevent a type confusion in the setcolor function that could\n  have been used to crash the interpreter or possibly have unspecified other\n  impact (bsc#1107412).\n- CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling\n  of /invalidaccess exceptions could be have been used by attackers able to\n  supply crafted PostScript to execute code using the 'pipe' instruction\n  (bsc#1107410).\n- CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF\n  primitives could have been used by remote attackers able to supply crafted PDFs\n  to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107411).\n- CVE-2018-16542: Prevent attackers able to supply crafted PostScript files\n  from using insufficient interpreter stack-size checking during error handling\n  to crash the interpreter (bsc#1107413).\n- CVE-2018-16541: Prevent attackers able to supply crafted PostScript files\n  from using incorrect free logic in pagedevice replacement to crash the\n  interpreter (bsc#1107421).\n- CVE-2018-16540: Prevent use-after-free in copydevice handling that could have\n  been used to crash the interpreter or possibly have unspecified other impact\n  (bsc#1107420).\n- CVE-2018-16539: Prevent attackers able to supply crafted PostScript files\n  from using incorrect access checking in temp file handling to disclose contents\n  of files on the system otherwise not readable (bsc#1107422).\n- CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have\n  an unspecified impact (bsc#1107423).\n- CVE-2018-16511: A type confusion in 'ztype' could have been used by remote\n  attackers able to supply crafted PostScript to crash the interpreter or\n  possibly have unspecified other impact (bsc#1107426).\n- CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even\n  though it is not intended for use during document processing (e.g., after the\n  startup phase). This lead to memory corruption, allowing remote attackers able\n  to supply crafted PostScript to crash the interpreter or possibly have\n  unspecified other impact (bsc#1107581).\n- CVE-2018-16802: Incorrect 'restoration of privilege' checking when running\n  out of stack during exception handling could have been used by attackers able\n  to supply crafted PostScript to execute code using the 'pipe' instruction. This\n  is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).\n\nThese non-security issues were fixed:\n\n* Fixes problems with argument handling, some unintended results of the\n  security fixes to the SAFER file access restrictions (specifically accessing\n  ICC profile files).\n* Avoid that ps2epsi fails with 'Error: /undefined in --setpagedevice--'\n\nFor additional changes please check http://www.ghostscript.com/doc/9.25/News.htm\n","status":"published","published":"2018-10-02T14:31:31Z","modified":"2026-02-04T03:48:44.241104Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3768-1","title":"ghostscript vulnerabilities","description":"Tavis Ormandy discovered multiple security issues in Ghostscript. If a user\nor automated system were tricked into processing a specially crafted file,\na remote attacker could possibly use these issues to access arbitrary\nfiles, execute arbitrary code, or cause a denial of service.\n","status":"published","published":"2018-09-19T07:21:20Z","modified":"2026-04-22T09:48:59.640451Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}