CVE-2018-16509 — Red Hat
HIGHCVE-2018-16509 is a high-severity (CVSS 7.8) vulnerability. 11 public exploit references exist, so weaponization risk is real. No vendor fix is recorded yet; mitigation options are listed below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2018-16509 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
Affected Products
ghostscriptartifexgpl ghostscriptartifexubuntu linuxcanonicaldebian linuxdebianenterprise linux desktopredhatenterprise linux serverredhatResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Ghostscript - Failed Restore Command Execution (Metasploit)
by Metasploit · Sep 10, 2018
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2018-16509 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the…
* ImageMagick relies on ghostscript when processing certain files formats. Thus, ImageMagick can be used as an attack vector. In order to prevent ImageMagick from processing those files on Red Hat Enterprise Linux 6 and 7, you can disable the use of ghostscript and the processing of PS, EPS, PDF, and XPS file formats in ImageMagick's security policy by opening /etc/ImageMagick/policy.xml and adding the following lines to the "<policymap>" section of the file: ``` <policy domain="coder" rights="none" pattern="PS" /> <policy domain="coder" rights="none" pattern="EPS" /> <policy domain="coder" rights="none" pattern="PDF" /> <policy domain="coder" rights="none" pattern="XPS" /> <policy…Source: Red Hat security advisory for CVE-2018-16509 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 6 | ghostscript-0:8.70-24.el6_10.2 | RHSA-2018:3760 |
| Red Hat Enterprise Linux 7 | ghostscript-0:9.07-29.el7_5.2 | RHSA-2018:2918 |
Frequently Asked Questions
Is CVE-2018-16509 in your dependencies?
Find it across , including transitive dependencies.