Uninitialized Memory Access in Artifex Ghostscript
Summary
CVE-2018-15911: In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code. Affects ghostscript versions < 9.24-r0. Fixed in 9.24-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an open-source interpreter for the PostScript language and PDF file format. It is widely used for rendering and processing documents. However, versions of Ghostscript prior to 9.24 are vulnerable to an uninitialized memory access issue in the aesdecode operator. This vulnerability can be exploited by attackers who are able to supply crafted PostScript code, potentially leading to a crash of the interpreter or even remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2018-15911, originates from an uninitialized memory access issue in the aesdecode operator of Artifex Ghostscript. Attackers can exploit this vulnerability by providing specially crafted PostScript code. If successful, this can result in the interpreter crashing or potentially executing arbitrary code. The severity of this vulnerability is rated as high, with a CVSS score of 7.8.
How To Fix
Minimum fixed version
9.24-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update to the fixed version of Ghostscript as mentioned above.
Conclusion
The uninitialized memory access vulnerability in Artifex Ghostscript can be mitigated by updating to version 9.24 or later. It is crucial to keep software up-to-date to ensure the security and integrity of document rendering and processing. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Ghostscript is an open-source interpreter for the PostScript language and PDF file format. It is commonly used for rendering and processing documents.
This vulnerability allows attackers to crash the interpreter or potentially execute arbitrary code by supplying crafted PostScript code.
To fix this vulnerability, update to Artifex Ghostscript version 9.24 or later.
No specific workaround has been provided. Updating to the fixed version is the recommended solution.
The severity of this vulnerability is rated as high, with a CVSS score of 7.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
