VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 15, 2018· Updated Aug 5, 2024

CVE-2018-18073

CVE-2018-18073

Description

Ghostscript -dSAFER sandbox escape via leaked system operators in $error execution stack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ghostscript -dSAFER sandbox escape via leaked system operators in $error execution stack.

Vulnerability

Artifex Ghostscript versions including 9.07 on Red Hat Enterprise Linux 7 are vulnerable to a sandbox bypass. The vulnerability resides in the PostScript error handling mechanism: when an error occurs, the $error dictionary can contain references to parts of the execution stack, including executeonly routines. An attacker can craft a PostScript file that triggers an error and accesses the $error.estack to obtain references to system operators such as .forceput and .systemvar, which are normally restricted under -dSAFER [1][2][3].

Exploitation

An attacker needs to supply a specially crafted PostScript file to Ghostscript invoked with -dSAFER. The attack sequence involves placing code that causes a PostScript error (e.g., executing .setglobal on a null object), catching the error with stopped, then reading the $error dictionary's /estack entry to recover operator arrays. The leaked operators can then be used to run arbitrary system commands [2].

Impact

Successful exploitation allows an attacker to bypass the -dSAFER sandbox and execute arbitrary shell commands on the victim's system with the privileges of the Ghostscript process, leading to full compromise of confidentiality, integrity, and availability of files accessible to that user [2][3].

Mitigation

Red Hat released erratum RHSA-2018:3834 updating Ghostscript to version 9.07-31.el7_6.6 on RHEL 7 [1]. Users should apply the vendor-supplied patch. If patching is not immediately possible, avoid processing untrusted PostScript or PDF files with Ghostscript. No workaround is provided in the references [2][3].

References
  1. https://access.redhat.com/errata/RHSA-2018:3834
  2. security - ghostscript: saved execution stacks can leak operator arrays (CVE-2018-18073)
  3. Making sure you're not a bot!

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

36

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

9

News mentions

0

No linked articles in our index yet.