VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 19, 2018· Updated Aug 5, 2024

CVE-2018-18284

CVE-2018-18284

Description

Ghostscript 9.25 and earlier allows sandbox escape via the 1Policy operator, which exposes .forceput and enables arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ghostscript 9.25 and earlier allows sandbox escape via the 1Policy operator, which exposes .forceput and enables arbitrary code execution.

Vulnerability

Artifex Ghostscript versions 9.25 and earlier contain a sandbox bypass vulnerability in the 1Policy operator. The operator was marked as executeonly and made a pseudo-operator, but it was essentially a wrapper around .forceput, allowing an attacker to access internal system procedures and bypass the sandbox restrictions [2].

Exploitation

An attacker can exploit this vulnerability by supplying a crafted PostScript file to a user or service that processes it with Ghostscript. The exploit involves defining a procedure that uses .policyprocs to retrieve the 1Policy operator and then invoke .forceput to modify protected dictionaries [2]. No authentication is required; only user interaction (e.g., opening a malicious file) is needed.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Ghostscript process, leading to full system compromise, including potential data disclosure, modification, or denial of service [2][4].

Mitigation

The vulnerability is fixed in Ghostscript version 9.26. Red Hat has released updated packages (ghostscript-9.07-31.el7_6.6) for Red Hat Enterprise Linux 7 [1]. Gentoo recommends upgrading to >=app-text/ghostscript-gpl-9.26 [4]. No known workaround exists for unpatched versions.

References
  1. https://access.redhat.com/errata/RHSA-2018:3834
  2. security - ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284
  3. Multiple vulnerabilities (GLSA 201811-12) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

36

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

11

News mentions

0

No linked articles in our index yet.