CVE-2018-10194: artifex ghostscript
Vulnerability summary
CVE-2018-10194 is a high (CVSS 7.8) vulnerability in artifex ghostscript. EPSS estimates a 2.05% chance of exploitation in the next 30 days, higher than 81.2% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 18-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.05%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
Increase +0.25 pp
From 1.80% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.7
- enterprise_linux_server_eus7.5 | 7.7
- enterprise_linux_server_tus7.7
Suse5 products
- ghostscript&distro=SUSE Linux Enterprise Desktop 12 SP3< 9.15-23.10.2
- ghostscript&distro=SUSE Linux Enterprise Module for Basesystem 15< 9.23-3.3.1
- ghostscript&distro=SUSE Linux Enterprise Server 12 SP3< 9.15-23.10.2
- ghostscript&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 9.15-23.10.2
- ghostscript&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 9.15-23.10.2
Alpine2 products
- ghostscript< 9.23-r0
- wireshark< 2.4.6-r0 | < 2.2.14-r0
Debian2 products
- ghostscript< 9.05~dfsg-6.3+deb7u8 | < 9.22~dfsg-2.1
- debian_linuxEOL7.0
Mageia2 products
- ghostscript< 9.23-1.mga5
- ghostscript< 9.23-1.mga6
Artifex1 product
- ghostscript≤ 9.22
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
Ubuntu1 product
- ghostscript< 9.10~dfsg-0ubuntu10.12 | < 9.18~dfsg~0-0ubuntu2.8 | < 9.22~dfsg+1-0ubuntu1.1
8 vendors · 20 products
References
20 links
lists.debian.org/debian-lts-announce/2018/04/msg00028.htmlMailing ListX Refsource MLISTThird Party Advisory