CVE-2018-16863

Published: Dic 03, 2018 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2018-8654 Aliases: GSD-2018-16863
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
HIGH 9,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: complete
Integrity: complete
Availability: complete

Description

AI Translation Available

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0008
Percentile
0,2th
Updated

EPSS Score Trend (Last 91 Days)

78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation
Potential Impacts:
Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Read Files Or Directories Modify Files Or Directories Read Application Data Modify Application Data Hide Activities
Applicable Platforms
Technologies: AI/ML, Not Technology-Specific, Web Server
Likelihood of Exploit: High
View CWE Details
184

Incomplete List of Disallowed Inputs

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
View CWE Details
Operating System

Enterprise Linux Desktop by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Desktop
Version 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Enterprise Linux Server by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Server
Version 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Ghostscript by Artifex

Product Information
Vendor Artifex
Product Ghostscript
Version 9.07
cpe:2.3:a:artifex:ghostscript:9.07:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Enterprise Linux Workstation by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Workstation
Version 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Enterprise Linux Server Aus by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Server Aus
Version 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Enterprise Linux Server Tus by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Server Tus
Version 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Enterprise Linux Server Eus by Redhat

Product Information
Vendor Redhat
Product Enterprise Linux Server Eus
Version 7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486
https://access.redhat.com/errata/RHSA-2018:3761
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3761
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
Issue Tracking Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=520bb0ea7519
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7…
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486
https://access.redhat.com/errata/RHSA-2018:3761
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3761
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863
Issue Tracking Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16863