According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The set_text_distance function in     devices/vector/gdevpdts.c in the pdfwrite component in     Artifex Ghostscript through 9.22 does not prevent     overflows in text-positioning calculation, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PDF document.(CVE-2018-10194)

  - In Artifex Ghostscript before 9.24, attackers able to     supply crafted PostScript files could use a type     confusion in the LockDistillerParams parameter to crash     the interpreter or execute code.(CVE-2018-15910)

  - An issue was discovered in Artifex Ghostscript before     9.24. Incorrect 'restoration of privilege' checking     during handling of /invalidaccess exceptions could be     used by attackers able to supply crafted PostScript to     execute code using the 'pipe'     instruction.(CVE-2018-16509)

  - In Artifex Ghostscript before 9.24, attackers able to     supply crafted PostScript files could use insufficient     interpreter stack-size checking during error handling     to crash the interpreter.(CVE-2018-16542)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2018-3430:01 advisory.

    * It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker     could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell     commands via a specially crafted PostScript document. (CVE-2018-16509)     Asianux would like to thank Tavis Ormandy (Google Project Zero) for reporting this issue.
    CVE-2018-16509     An issue was discovered in Artifex Ghostscript before 9.24. Incorrect restoration of privilege checking     during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript     to execute code using the pipe instruction.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Tavis Ormandy discovered multiple vulnerabilities in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

For Debian 8 'Jessie', these problems have been fixed in version 9.06~dfsg-2+deb8u8.

We recommend that you upgrade your ghostscript packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

  - CVE-2018-17183: Remote attackers were be able to supply     crafted PostScript to potentially overwrite or replace     error handlers to inject code (bsc#1109105)

  - CVE-2018-15909: Prevent type confusion using the .shfill     operator that could have been used by attackers able to     supply crafted PostScript files to crash the interpreter     or potentially execute code (bsc#1106172).

  - CVE-2018-15908: Prevent attackers that are able to     supply malicious PostScript files to bypass .tempfile     restrictions and write files (bsc#1106171).

  - CVE-2018-15910: Prevent a type confusion in the     LockDistillerParams parameter that could have been used     to crash the interpreter or execute code (bsc#1106173).

  - CVE-2018-15911: Prevent use uninitialized memory access     in the aesdecode operator that could have been used to     crash the interpreter or potentially execute code     (bsc#1106195).

  - CVE-2018-16513: Prevent a type confusion in the setcolor     function that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107412).

  - CVE-2018-16509: Incorrect 'restoration of privilege'     checking during handling of /invalidaccess exceptions     could be have been used by attackers able to supply     crafted PostScript to execute code using the 'pipe'     instruction (bsc#1107410).

  - CVE-2018-16510: Incorrect exec stack handling in the     'CS' and 'SC' PDF primitives could have been used by     remote attackers able to supply crafted PDFs to crash     the interpreter or possibly have unspecified other     impact (bsc#1107411).

  - CVE-2018-16542: Prevent attackers able to supply crafted     PostScript files from using insufficient interpreter     stack-size checking during error handling to crash the     interpreter (bsc#1107413).

  - CVE-2018-16541: Prevent attackers able to supply crafted     PostScript files from using incorrect free logic in     pagedevice replacement to crash the interpreter     (bsc#1107421).

  - CVE-2018-16540: Prevent use-after-free in copydevice     handling that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107420).

  - CVE-2018-16539: Prevent attackers able to supply crafted     PostScript files from using incorrect access checking in     temp file handling to disclose contents of files on the     system otherwise not readable (bsc#1107422).

  - CVE-2018-16543: gssetresolution and gsgetresolution     allowed attackers to have an unspecified impact     (bsc#1107423).

  - CVE-2018-16511: A type confusion in 'ztype' could have     been used by remote attackers able to supply crafted     PostScript to crash the interpreter or possibly have     unspecified other impact (bsc#1107426).

  - CVE-2018-16585: The .setdistillerkeys PostScript command     was accepted even though it is not intended for use     during document processing (e.g., after the startup     phase). This lead to memory corruption, allowing remote     attackers able to supply crafted PostScript to crash the     interpreter or possibly have unspecified other impact     (bsc#1107581).

  - CVE-2018-16802: Incorrect 'restoration of privilege'     checking when running out of stack during exception     handling could have been used by attackers able to     supply crafted PostScript to execute code using the     'pipe' instruction. This is due to an incomplete fix for     CVE-2018-16509 (bsc#1108027).

These non-security issues were fixed :

  - Fixes problems with argument handling, some unintended     results of the security fixes to the SAFER file access     restrictions (specifically accessing ICC profile files).

  - Avoid that ps2epsi fails with 'Error: /undefined in
    --setpagedevice--'

For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm

This update was imported from the SUSE:SLE-15:Update update project.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document.
(CVE-2018-16509)

* ghostscript: LockDistillerParams type confusion (699656) (CVE-2018-15910)

* ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668) (CVE-2018-16542)

* ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c (CVE-2018-10194)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Tavis Ormandy (Google Project Zero) for reporting CVE-2018-16509, CVE-2018-15910, and CVE-2018-16542.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
122709	EulerOS Virtualization 2.5.2 : ghostscript (EulerOS-SA-2019-1087)	Nessus	Huawei Local Security Checks	2019/3/8	2024/6/14	high
290046	MiracleLinux 4 : ghostscript-8.70-24.AXS4.2 (AXSA:2018-3430:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/6	high
117487	Debian DLA-1504-1 : ghostscript security update	Nessus	Debian Local Security Checks	2018/9/14	2024/8/8	high
117504	Debian DSA-4294-1 : ghostscript - security update	Nessus	Debian Local Security Checks	2018/9/17	2024/8/7	high
117980	openSUSE Security Update : ghostscript (openSUSE-2018-1123)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
118118	CentOS 7 : ghostscript (CESA-2018:2918)	Nessus	CentOS Local Security Checks	2018/10/16	2019/12/31	high

検出

プラグインの検索

high

high

high

high

high

high