CVE-2018-18284 Security feature bypass in n/a

High 8.6 Published 19 Oct 2018 Updated 5 Aug 2024

Attackers can bypass Ghostscript sandbox protections using the 1Policy operator, potentially enabling further exploitation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-18284?

CVE-2018-18284 is a high-severity vulnerability in Artifex Ghostscript, published on 19 Oct 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.

Which versions are affected by CVE-2018-18284?

It affects 11 products.

Products include Artifex Ghostscript, Artifex Gpl Ghostscript, Canonical Ubuntu Linux, Debian Debian Linux, Pulsesecure Pulse Connect Secure, Redhat Enterprise Linux Desktop and 5 more.

How do I fix CVE-2018-18284?

Upgrade to a fixed version.

Is CVE-2018-18284 being exploited?

There is no known exploitation of CVE-2018-18284 in the wild and no public exploit code.

All Artifex Ghostscript vulnerabilities

Sources

Also known as ALPINE-CVE-2018-18284, DEBIAN-CVE-2018-18284, GHSA-ffjv-4h53-5j44, UBUNTU-CVE-2018-18284.