Critical Vulnerability in Ghostscript: LockSafetyParams Misconfiguration
Summary
ALPINE-CVE-2018-19409: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. Affects ghostscript versions < 9.26-r0. Fixed in 9.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation and conversion. However, it has been found to have a critical vulnerability that can expose systems to potential attacks.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 9.26. The vulnerability arises from the improper checking of LockSafetyParams when another device is used. This oversight can lead to unauthorized access and manipulation of documents, potentially allowing attackers to exploit the system. The vulnerability has a CVSS score of 9.8, indicating a high severity level, which means it can have serious ramifications if left unaddressed.
How To Fix
Minimum fixed version
9.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Ghostscript interpreter or limit its use in environments where sensitive documents are processed. This can help mitigate the risk until the package is updated.
Conclusion
The vulnerability in Ghostscript poses a significant risk to systems that utilize this package for document processing. It is crucial to update to the patched version to mitigate potential threats. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability involves improper checks of LockSafetyParams, which can lead to unauthorized access and manipulation of documents.
The vulnerability has a CVSS score of 9.8, indicating it is critical and can have serious consequences if exploited.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update Ghostscript to version 9.26-r0 or later to patch the vulnerability and ensure your system is secure.
While specific exploits may not be publicly documented, the nature of the vulnerability suggests that attackers could potentially exploit it to gain unauthorized access to sensitive documents.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
