Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

CVE-2018-18284 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2018-18284

CVE-2018-18284

HIGH8.6

Artifex Ghostscript 9

Published Oct 19, 2018

Modified 1 years ago

Details

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.

References

WEB

http://git.ghostscript.com/?p=ghostpdl.git%3Bh=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b

WEB

http://www.openwall.com/lists/oss-security/2018/10/16/2

WEB

http://www.securityfocus.com/bid/107451

ADVISORY

https://access.redhat.com/errata/RHSA-2018:3834

WEB

https://bugs.chromium.org/p/project-zero/issues/detail?id=1696

WEB

https://bugs.ghostscript.com/show_bug.cgi?id=699963

WEB

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

WEB

https://lists.debian.org/debian-lts-announce/2018/10/msg00013.html

ADVISORY

https://security.gentoo.org/glsa/201811-12

WEB

https://support.f5.com/csp/article/K22141757?utm_source=f5support&amp%3Butm_medium=RSS

ADVISORY

https://usn.ubuntu.com/3803-1/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2018-18284

ADVISORY

https://www.debian.org/security/2018/dsa-4336

CVSS Analysis

CVSS v3.0

8.6

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.6/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Ecosystems

Timeline

PublishedOct 19, 2018

ModifiedAug 5, 2024