Description
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://security.gentoo.org/glsa/201811-12 ↗
- https://usn.ubuntu.com/3768-1/ ↗
- https://bugs.ghostscript.com/show_bug.cgi?id=699665 ↗
- https://access.redhat.com/errata/RHSA-2018:3834 ↗
- https://www.kb.cert.org/vuls/id/332928 ↗
- https://www.debian.org/security/2018/dsa-4288 ↗
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8e9ce5016db968b40e4ec255a3005f2786cce45f ↗
- https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html ↗
- http://www.securityfocus.com/bid/105122 ↗
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 ↗
- https://support.f5.com/csp/article/K22141757?utm_source=f5support&%3Butm_medium=RSS ↗