CVE-2018-15909

Publication date 27 August 2018

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.8 · High

Score breakdown

Description

In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.

Read the notes from the security team

Status

Package Ubuntu Release Status
ghostscript 18.04 LTS bionic
Fixed 9.22~dfsg+1-0ubuntu1.2
16.04 LTS xenial
Fixed 9.18~dfsg~0-0ubuntu2.9
14.04 LTS trusty
Fixed 9.10~dfsg-0ubuntu10.13

Notes

mdeslaur

CVE-2018-16585 patches need to be applied first

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ghostscript

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.8 · High

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-3768-1
    • Ghostscript vulnerabilities
    • 19 September 2018

Other references

Access our resources on patching vulnerabilities