7.8

CVE-2018-15911

In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Artifex ≫ Ghostscript Version <= 9.23
Artifex ≫ Gpl Ghostscript Version < 9.26
Pulsesecure ≫ Pulse Connect Secure Version >= 8.2r1.0 < 8.2r12.1
Pulsesecure ≫ Pulse Connect Secure Version >= 8.3r1 < 8.3r7.1
Pulsesecure ≫ Pulse Connect Secure Version >= 9.0r1 < 9.0r3.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.04% 0.858
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/3768-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4288
Third Party Advisory
https://www.kb.cert.org/vuls/id/332928
Patch
Third Party Advisory
US Government Resource
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
Patch
Third Party Advisory
http://www.securityfocus.com/bid/105122
Third Party Advisory
VDB Entry
https://support.f5.com/csp/article/K22141757?utm_source=f5support&amp%3Butm_medium=RSS
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8e9ce5016db968b40e4ec255a3005f2786cce45f
https://access.redhat.com/errata/RHSA-2018:3834
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=699665
Vendor Advisory
Permissions Required