Ghostscript Remote Access Bypass Vulnerability - CVE-2018-19475
Summary
ALPINE-CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. Affects ghostscript versions < 9.26-r0. Fixed in 9.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is integral to many applications that require document manipulation, making it a critical component in numerous systems. However, Ghostscript has been found to have a vulnerability that could allow unauthorized access to restricted resources.
Vulnerability Detail
The vulnerability identified as CVE-2018-19475 exists in the psi/zdevice2.c file of Ghostscript versions prior to 9.26. It allows remote attackers to bypass intended access restrictions due to insufficient checks on available stack space when the device remains unchanged. This could lead to unauthorized access to sensitive information or system resources, posing a significant risk to affected systems.
How To Fix
Minimum fixed version
9.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Ghostscript service or implementing network-level security measures to limit exposure to potential attackers until the package can be updated.
Conclusion
The Ghostscript vulnerability CVE-2018-19475 poses a significant risk due to its potential to allow unauthorized access to restricted resources. It is crucial for users to update to the patched version 9.26-r0 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2018-19475 is a vulnerability in Ghostscript that allows remote attackers to bypass access restrictions due to insufficient stack space checks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
If exploited, this vulnerability could allow unauthorized access to sensitive data or system resources, leading to data breaches or system compromise.
Yes, a patch is available in Ghostscript version 9.26-r0 and later. It is recommended to update to this version to mitigate the risk.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file. It provides real-time insights without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
