CVE-2018-19134

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

• CWE-704

• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=693baf02152119af6e6afd30bb8ec76d14f84bbf
• http://www.securityfocus.com/bid/106278Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3834Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=700141Issue Tracking, Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00019.htmlThird Party Advisory
• https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdfExploit, Third Party Advisory
• https://www.ghostscript.com/doc/9.26/News.htmRelease Notes
• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=693baf02152119af6e6afd30bb8ec76d14f84bbf
• http://www.securityfocus.com/bid/106278Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3834Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=700141Issue Tracking, Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00019.htmlThird Party Advisory
• https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdfExploit, Third Party Advisory
• https://www.ghostscript.com/doc/9.26/News.htmRelease Notes

Published

Dec 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19129In Libav 12.3, a NULL pointer dereference (RIP points to zer…
• CVE-2018-1913IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.…5.4
• CVE-2018-19130In Libav 12.3, there is an invalid memory access in vc1_deco…
• CVE-2018-19131Squid before 4.4 has XSS via a crafted X.509 certificate dur…
• CVE-2018-19132Squid before 4.4, when SNMP is enabled, allows a denial of s…
• CVE-2018-19133In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyo…
• CVE-2018-19135ClipperCMS 1.3.3 does not have CSRF protection on its kcfind…
• CVE-2018-19136DomainMOD through 4.11.01 has XSS via the assets/edit/regist…
• CVE-2018-19137DomainMOD through 4.11.01 has XSS via the assets/edit/ip-add…
• CVE-2018-19138WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.ht…
• CVE-2018-19139An issue has been found in JasPer 2.0.14. There is a memory …
• CVE-2018-1914IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6…5.4