CVE-2018-16543

It was discovered that the ghostscript gssetresolution and gsgetresolution procedures were available, although they have dangerous side effects. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

CVE-2018-16543 requires the "device subclassing" feature to be present in ghostscript in order to exploit it and corrupt the interpreter's memory. This feature appeared in Ghostscript-9.18. Thus ghostscript 9.07, as shipped in Red Hat Enterprise Linux 7, and older are not affected : although the attacker has access to the gssetresolution and gsgetresolution operators, they can not use these to corrupt memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.