Critical Denial of Service Vulnerability in Ghostscript Affects Multiple Alpine Versions
Summary
ALPINE-CVE-2018-10194: The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause... Affects ghostscript versions < 9.23-r0. Fixed in 9.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for rendering and converting documents in various formats. The vulnerability in question affects multiple versions of Ghostscript packaged in Alpine Linux, making it crucial for users to be aware of the potential risks associated with using this software.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10194, originates from the set_text_distance function in the pdfwrite component of Ghostscript. This function does not adequately prevent overflows during text-positioning calculations. As a result, remote attackers can exploit this flaw by crafting malicious PDF documents, leading to denial of service (application crash) or potentially other unspecified impacts. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
9.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted PDF documents that may exploit this vulnerability until the package is updated to a secure version.
Conclusion
The vulnerability CVE-2018-10194 in Ghostscript poses a significant risk to users of Alpine Linux. It is essential to update to the patched version to mitigate the risk of denial of service attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can alert them in real-time without requiring code access.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2018-10194 is a vulnerability in Ghostscript that allows remote attackers to cause a denial of service through crafted PDF documents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of Ghostscript prior to 9.23-r0 in Alpine Linux are affected by this vulnerability.
If an immediate update is not possible, avoid opening any untrusted PDF files that could exploit this vulnerability.
The CVSS score for this vulnerability is 7.8, indicating a high severity level that could lead to application crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
