The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ghostscript-cupsUpgrade ghostscript-debuginfoUpgrade ghostscript-develUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript | Apr 27, 2020 | Sep 6, 2018 |
| Debian | — | Upgrade ghostscript | Sep 9, 2018 | Sep 6, 2018 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Nov 26, 2018 | Sep 6, 2018 |
| Ghostscript | — | Upgrade to Ghostscript version 9.24 | Oct 10, 2018 | Sep 6, 2018 |
| Suse | — | Upgrade libspectre1Upgrade ghostscript-mini-develUpgrade ghostscript-develUpgrade ghostscriptUpgrade libspectre-develUpgrade ghostscript-miniUpgrade ghostscript-x11 | Oct 3, 2018 | Sep 6, 2018 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libgs9 | Oct 2, 2018 | Sep 6, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub