An issue was discovered in Artifex Ghostscript before 9.24.
Priority HIGH 77Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 18 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
Why it matters now
EPSS 0.92499 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 18 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* | before 9.24 | Vulnerable | Artifex |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* Versions before 9.24 Vulnerable ·Artifex
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:* | before 9.26 | Vulnerable | Artifex |
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:* Versions before 9.26 Vulnerable ·Artifex
Remediation
Red Hat 2 advisories
- RHSA-2018:3760 Released 2018-12-03 · Red Hat rating Importantghostscript security update
- Red Hat Enterprise Linux Desktop (v. 6) ghostscript-8.70-24.el6_10.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) ghostscript-devel-8.70-24.el6_10.2, ghostscript-doc-8.70-24.el6_10.2, ghostscript-gtk-8.70-24.el6_10.2
- Red Hat Enterprise Linux HPC Node (v. 6) ghostscript-8.70-24.el6_10.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ghostscript-devel-8.70-24.el6_10.2, ghostscript-doc-8.70-24.el6_10.2, ghostscript-gtk-8.70-24.el6_10.2
- Red Hat Enterprise Linux Server (v. 6) ghostscript-8.70-24.el6_10.2, ghostscript-8.70-24.el6_10.2.ppc
- Red Hat Enterprise Linux Server Optional (v. 6) ghostscript-devel-8.70-24.el6_10.2, ghostscript-devel-8.70-24.el6_10.2.ppc, ghostscript-doc-8.70-24.el6_10.2 +1
- Red Hat Enterprise Linux Workstation (v. 6) ghostscript-8.70-24.el6_10.2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ghostscript-devel-8.70-24.el6_10.2, ghostscript-doc-8.70-24.el6_10.2, ghostscript-gtk-8.70-24.el6_10.2
- RHSA-2018:2918 Released 2018-10-16 · Red Hat rating Importantghostscript security update
- Red Hat Enterprise Linux Client (v. 7) ghostscript-9.07-29.el7_5.2, ghostscript-cups-9.07-29.el7_5.2
- Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-devel-9.07-29.el7_5.2, ghostscript-doc-9.07-29.el7_5.2, ghostscript-gtk-9.07-29.el7_5.2
- Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript-9.07-29.el7_5.2, ghostscript-cups-9.07-29.el7_5.2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-devel-9.07-29.el7_5.2, ghostscript-doc-9.07-29.el7_5.2, ghostscript-gtk-9.07-29.el7_5.2
- Red Hat Enterprise Linux Server (v. 7) ghostscript-9.07-29.el7_5.2, ghostscript-9.07-29.el7_5.2.ppc, ghostscript-cups-9.07-29.el7_5.2
- Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-devel-9.07-29.el7_5.2, ghostscript-devel-9.07-29.el7_5.2.ppc, ghostscript-doc-9.07-29.el7_5.2 +1
- Red Hat Enterprise Linux Workstation (v. 7) ghostscript-9.07-29.el7_5.2, ghostscript-cups-9.07-29.el7_5.2
- Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-devel-9.07-29.el7_5.2, ghostscript-doc-9.07-29.el7_5.2, ghostscript-gtk-9.07-29.el7_5.2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ghostscript-9.07-29.el7_5.2, ghostscript-cups-9.07-29.el7_5.2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) ghostscript-devel-9.07-29.el7_5.2, ghostscript-doc-9.07-29.el7_5.2, ghostscript-gtk-9.07-29.el7_5.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2018:3760 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2018:2918 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2018:2918 |
Not affected: 12 products
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 3.10
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 3.2
- Red Hat OpenShift Container Platform 3.3
- Red Hat OpenShift Container Platform 3.4
- Red Hat OpenShift Container Platform 3.5
- Red Hat OpenShift Container Platform 3.6
- Red Hat OpenShift Container Platform 3.7
- Red Hat OpenShift Container Platform 3.9
- Red Hat OpenShift Enterprise 3.0
- Red Hat OpenShift Enterprise 3.1
Timeline
- 2026-10-02 Threatist record created from CVE-2018-16509
- 2026-10-03 Alias added: GHSA-98rm-3v6h-p8j6
References
Advisory 8
Other 4
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33662a2afdc377159f70218e67bde5
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486a6595c43f1de1cd7ade696020a31
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d590b4a91afac2e8417360b934156
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=520bb0ea7519aa3e79db78aaf0589dae02103764
Sources
- CVE-2018-16509 · CVE Program
- CVE-2018-16509 · NVD
- FIRST EPSS
- GHSA-98rm-3v6h-p8j6 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-16509 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences