CVEvulnerability

CVE-2018-15909

7.8 HIGH Published 2018-08-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-704

Description

In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.

Affected configurations

• debian debian linux 8.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • artifex ghostscript (<= 9.23) • artifex gpl ghostscript (< 9.26) • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server eus 7.6 • redhat enterprise linux server tus 7.6 • redhat enterprise linux workstation 7.0 • pulsesecure pulse connect secure (>= 8.2r1.0 < 8.2r12.1) • pulsesecure pulse connect secure (>= 8.3r1 < 8.3r7.1) • pulsesecure pulse connect secure (>= 9.0r1 < 9.0r3.4)

Related

Weakness · CWE (1)

  • CWE-704 Incorrect Type Conversion or Cast weakness

References