CVE-2018-18284

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.6 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
VendorProductVersion
artifexghostscript
𝑥
≤ 9.25
debiandebian_linux
8.0
debiandebian_linux
9.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
artifexgpl_ghostscript
𝑥
< 9.26
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_workstation
7.0
pulsesecurepulse_connect_secure
8.2r1.0 ≤
𝑥
< 8.2r12.1
pulsesecurepulse_connect_secure
8.3r1 ≤
𝑥
< 8.3r7.1
pulsesecurepulse_connect_secure
9.0r1 ≤
𝑥
< 9.0r3.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ghostscript
bullseye
9.53.3~dfsg-7+deb11u7
fixed
bullseye (security)
9.53.3~dfsg-7+deb11u8
fixed
bookworm
10.0.0~dfsg-11+deb12u4
fixed
bookworm (security)
10.0.0~dfsg-11+deb12u5
fixed
sid
10.04.0~dfsg-1
fixed
trixie
10.04.0~dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ghostscript
cosmic
Fixed 9.25~dfsg+1-0ubuntu1.1
released
bionic
Fixed 9.25~dfsg+1-0ubuntu0.18.04.2
released
xenial
Fixed 9.25~dfsg+1-0ubuntu0.16.04.2
released
trusty
Fixed 9.25~dfsg+1-0ubuntu0.14.04.2
released