In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact. External Reference: https://www.kb.cert.org/vuls/id/332928 https://www.artifex.com/news/ghostscript-security-resolved/ Upstream Bug: https://bugs.ghostscript.com/show_bug.cgi?id=699670 Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=f52734ba87 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c9b362ba908c http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5b5536fa88a9
Created ghostscript tracking bugs for this issue: Affects: fedora-all [bug 1625852]
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=f52734ba87 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c9b362ba908c http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5b5536fa88a9
Statement: CVE-2018-16543 requires the "device subclassing" feature to be present in ghostscript in order to exploit it and corrupt the interpreter's memory. This feature appeared in Ghostscript-9.18. Thus ghostscript 9.07, as shipped in Red Hat Enterprise Linux 7, and older are not affected : although the attacker has access to the gssetresolution and gsgetresolution operators, they can not use these to corrupt memory.