CVE-2018-16509 Code injection in n/a

High 7.8 Published 5 Sep 2018 Updated 5 Aug 2024

Attackers can execute arbitrary code via crafted PostScript files due to improper privilege restoration checks in Ghostscript.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-16509?

CVE-2018-16509 is a high-severity code injection vulnerability in Artifex Ghostscript, published on 5 Sep 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

Which versions are affected by CVE-2018-16509?

It affects 8 products.

Linux distribution packages (20)

`ghostscript` Red Hat:enterprise_linux:6::client	All versions	`0:8.70-24.el6_10.2`
`ghostscript-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:8.70-24.el6_10.2`
`ghostscript-devel` Red Hat:enterprise_linux:6::client	All versions	`0:8.70-24.el6_10.2`
`ghostscript-doc` Red Hat:enterprise_linux:6::client	All versions	`0:8.70-24.el6_10.2`
`ghostscript-gtk` Red Hat:enterprise_linux:6::client	All versions	`0:8.70-24.el6_10.2`
`ghostscript` Red Hat:enterprise_linux:6::computenode	All versions	`0:8.70-24.el6_10.2`
`ghostscript-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:8.70-24.el6_10.2`
`ghostscript-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:8.70-24.el6_10.2`
`ghostscript-doc` Red Hat:enterprise_linux:6::computenode	All versions	`0:8.70-24.el6_10.2`
`ghostscript-gtk` Red Hat:enterprise_linux:6::computenode	All versions	`0:8.70-24.el6_10.2`
`ghostscript` Red Hat:enterprise_linux:6::server	All versions	`0:8.70-24.el6_10.2`
`ghostscript-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:8.70-24.el6_10.2`
`ghostscript-devel` Red Hat:enterprise_linux:6::server	All versions	`0:8.70-24.el6_10.2`
`ghostscript-doc` Red Hat:enterprise_linux:6::server	All versions	`0:8.70-24.el6_10.2`
`ghostscript-gtk` Red Hat:enterprise_linux:6::server	All versions	`0:8.70-24.el6_10.2`
`ghostscript` Red Hat:enterprise_linux:6::workstation	All versions	`0:8.70-24.el6_10.2`
`ghostscript-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:8.70-24.el6_10.2`
`ghostscript-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:8.70-24.el6_10.2`
`ghostscript-doc` Red Hat:enterprise_linux:6::workstation	All versions	`0:8.70-24.el6_10.2`
`ghostscript-gtk` Red Hat:enterprise_linux:6::workstation	All versions	`0:8.70-24.el6_10.2`

Products include Artifex Ghostscript, Artifex Gpl Ghostscript, Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 2 more.

How do I fix CVE-2018-16509?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-16509 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-16509 exists.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 5 proofs of concept on GitHub.

All Artifex Ghostscript vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-16509, GHSA-98rm-3v6h-p8j6, RHSA-2018:3760, UBUNTU-CVE-2018-16509.