Open Source Vulnerability in Ghostscript: CVE-2018-19475
Summary
CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. Affects ghostscript versions < 9.26-r0. Fixed in 9.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability identified as CVE-2018-19475 in Ghostscript allows remote attackers to bypass access restrictions due to a lack of stack space checks when the device remains the same.
Vulnerability Detail
The vulnerability in Ghostscript (CVE-2018-19475) arises from the failure to check available stack space when the device remains unchanged. This flaw can be exploited by remote attackers to bypass intended access restrictions. The impact of this vulnerability can be severe, potentially leading to unauthorized access and execution of arbitrary code.
How To Fix
Minimum fixed version
9.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update to the fixed version as soon as possible.
Conclusion
The vulnerability (CVE-2018-19475) in Ghostscript poses a significant risk, allowing remote attackers to bypass access restrictions. It is crucial to update to the fixed version (9.26-r0 or later) to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and execution of arbitrary code.
To fix this vulnerability, update Ghostscript to version 9.26-r0 or later.
No specific workaround has been provided. It is recommended to update to the fixed version.
For more information, refer to the official CVE-2018-19475 entry or contact the vendor for support.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
