Denial of Service in Artifex Ghostscript through 9.22
Summary
CVE-2018-10194: The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause... Affects ghostscript versions < 9.23-r0. Fixed in 9.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an interpreter for the PostScript language and for PDF files. It is widely used for rendering and manipulating documents in various applications. However, versions up to 9.22 of Ghostscript are vulnerable to a denial of service attack due to an overflow in the text-positioning calculation in the pdfwrite component. This vulnerability can be exploited by remote attackers through a crafted PDF document, potentially leading to an application crash or other unspecified impacts.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10194, arises from the set_text_distance function in devices/vector/gdevpdts.c. This function does not properly handle overflows in text-positioning calculation, allowing attackers to exploit the vulnerability. By sending a specially crafted PDF document, remote attackers can trigger a denial of service condition, causing the application to crash. The exact impact of the vulnerability may vary and could potentially lead to other unspecified consequences.
How To Fix
Minimum fixed version
9.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability. It is advised to update to the latest version of Ghostscript as soon as possible.
Conclusion
The vulnerability in Artifex Ghostscript through version 9.22 can lead to a denial of service condition or other unspecified impacts when processing a specially crafted PDF document. To mitigate the risk, it is crucial to update to Ghostscript version 9.23 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Ghostscript is an interpreter for the PostScript language and for PDF files. It is widely used for rendering and manipulating documents in various applications.
The vulnerability allows remote attackers to cause a denial of service (application crash) or potentially have other unspecified impacts by sending a specially crafted PDF document.
To fix this vulnerability, update Ghostscript to version 9.23 or later.
No known workarounds are available for this vulnerability. It is recommended to update to the latest version of Ghostscript.
For more information, refer to the CVE-2018-10194 entry in the National Vulnerability Database (NVD) or the provided database-specific source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
