Critical Memory Access Vulnerability in Ghostscript Package
Summary
ALPINE-CVE-2018-15911: In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code. Affects ghostscript versions < 9.24-r0. Fixed in 9.24-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation, conversion, and rendering. However, Ghostscript has been found to have a vulnerability that allows attackers to exploit uninitialized memory access, potentially leading to crashes or arbitrary code execution.
Vulnerability Detail
In Artifex Ghostscript version 9.23, prior to August 24, 2018, a vulnerability was identified in the aesdecode operator. Attackers could supply crafted PostScript that would lead to uninitialized memory access, causing the interpreter to crash or allowing the execution of arbitrary code. This vulnerability poses significant risks, including denial of service and potential unauthorized access to system resources.
How To Fix
Minimum fixed version
9.24-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Ghostscript interpreter or disabling features that allow the execution of untrusted PostScript code until the package can be updated.
Conclusion
The vulnerability in Ghostscript poses significant risks to systems utilizing this package. It is crucial to update to the patched version to mitigate these risks effectively. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for ghostscript →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include system crashes and unauthorized code execution, which could compromise the integrity and availability of the system.
Yes, you can mitigate the risk by restricting access to the Ghostscript interpreter and disabling the execution of untrusted PostScript code.
More information about Ghostscript can be found on its official website or through its documentation, which provides insights into its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
