CVE-2018-15911

In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.

• CWE-908

• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8e9ce5016db968b40e4ec255a3005f2786cce45f
• http://www.securityfocus.com/bid/105122Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3834Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=699665Permissions Required, Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00015.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201811-12Third Party Advisory
• https://support.f5.com/csp/article/K22141757?utm_source=f5support&amp%3Butm_medium=RSS
• https://usn.ubuntu.com/3768-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4288Third Party Advisory
• https://www.kb.cert.org/vuls/id/332928Patch, Third Party Advisory, US Government Resource
• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8e9ce5016db968b40e4ec255a3005f2786cce45f
• http://www.securityfocus.com/bid/105122Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3834Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=699665Permissions Required, Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00015.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201811-12Third Party Advisory
• https://support.f5.com/csp/article/K22141757?utm_source=f5support&amp%3Butm_medium=RSS
• https://usn.ubuntu.com/3768-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4288Third Party Advisory
• https://www.kb.cert.org/vuls/id/332928Patch, Third Party Advisory, US Government Resource

Published

Aug 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15904A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 befo…
• CVE-2018-15906SolarWinds Serv-U FTP Server 15.1.6 allows remote authentica…
• CVE-2018-15907Technicolor (formerly RCA) TC8305C devices allow remote atta…
• CVE-2018-15908In Artifex Ghostscript 9.23 before 2018-08-23, attackers are…
• CVE-2018-15909In Artifex Ghostscript 9.23 before 2018-08-24, a type confus…
• CVE-2018-15910In Artifex Ghostscript before 9.24, attackers able to supply…
• CVE-2018-15912An issue was discovered in manjaro-update-system.sh in manja…
• CVE-2018-15913An issue was discovered in Cloudera Manager 5.x through 5.15…6.1
• CVE-2018-15917Persistent cross-site scripting (XSS) issues in Jorani 0.6.5…
• CVE-2018-15918An issue was discovered in Jorani 0.6.5. SQL Injection (erro…
• CVE-2018-15919Remotely observable behaviour in auth-gss2.c in OpenSSH thro…5.3
• CVE-2018-15920Adobe Acrobat and Reader versions 2018.011.20063 and earlier…