CVSS 3.0
7.8 highCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2018-16863
High (7.8). EPSS 1.2% chance of exploitation in the next 30 days.
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-184, CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- artifex:ghostscript
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
References
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486
- https://access.redhat.com/errata/RHSA-2018:3761