CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS
Percentile
64.5%
Severity: High
Date : 2018-11-06
CVE-ID : CVE-2018-17961 CVE-2018-18073 CVE-2018-18284
Package : ghostscript
Type : sandbox escape
Remote : Yes
Link : https://security.archlinux.org/AVG-786
The package ghostscript before version 9.25-4 is vulnerable to sandbox
escape.
Upgrade to 9.25-4.
The problems have been fixed upstream but no release is available yet.
None.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a
sandbox protection mechanism via vectors involving errorhandler setup.
Artifex Ghostscript allows attackers to bypass a sandbox protection
mechanism by leveraging exposure of system operators in the saved
execution stack in an error object.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a
sandbox protection mechanism via vectors involving the 1Policy
operator.
A remote attacker is able to escape the sandbox via a specially crafted
PostScript document.
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a54c9e61e7d02bbc620bcba9b1c208462a876afb
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63aa4ac6874234fe8cd63e72077291
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a6807394bd94b708be24758287b606154daaaed9
https://www.openwall.com/lists/oss-security/2018/10/09/4
https://bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2
https://bugs.ghostscript.com/show_bug.cgi?id=699816
https://lists.debian.org/debian-lts-announce/2018/10/msg00013.html
https://www.exploit-db.com/exploits/45573/
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=34cc326eb2c5695833361887fe0b32e8d987741c
http://packetstormsecurity.com/files/149758/Ghostscript-Exposed-System-Operators.html
http://www.openwall.com/lists/oss-security/2018/10/10/12
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b
https://www.openwall.com/lists/oss-security/2018/10/16/2
https://bugs.chromium.org/p/project-zero/issues/detail?id=1696
https://bugs.ghostscript.com/show_bug.cgi?id=699963
https://security.archlinux.org/CVE-2018-17961
https://security.archlinux.org/CVE-2018-18073
https://security.archlinux.org/CVE-2018-18284
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | ghostscript | < 9.25-4 | UNKNOWN |
packetstormsecurity.com/files/149758/Ghostscript-Exposed-System-Operators.html
www.openwall.com/lists/oss-security/2018/10/10/12
bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2
bugs.chromium.org/p/project-zero/issues/detail?id=1696
bugs.ghostscript.com/show_bug.cgi?id=699816
bugs.ghostscript.com/show_bug.cgi?id=699963
git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=34cc326eb2c5695833361887fe0b32e8d987741c
git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b
git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a54c9e61e7d02bbc620bcba9b1c208462a876afb
git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63aa4ac6874234fe8cd63e72077291
git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a6807394bd94b708be24758287b606154daaaed9
lists.debian.org/debian-lts-announce/2018/10/msg00013.html
security.archlinux.org/AVG-786
security.archlinux.org/CVE-2018-17961
security.archlinux.org/CVE-2018-18073
security.archlinux.org/CVE-2018-18284
www.exploit-db.com/exploits/45573/
www.openwall.com/lists/oss-security/2018/10/09/4
www.openwall.com/lists/oss-security/2018/10/16/2
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS
Percentile
64.5%