Type Confusion Vulnerability in Artifex Ghostscript
Summary
CVE-2018-19477: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion. Affects ghostscript versions < 9.26-r0. Fixed in 9.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents. However, a type confusion vulnerability (CVE-2018-19477) has been discovered in Ghostscript versions prior to 9.26. This vulnerability allows remote attackers to bypass access restrictions through a JBIG2Decode type confusion.
Vulnerability Detail
The type confusion vulnerability in Ghostscript arises from a flaw in the 'psi/zfjbig2.c' file. Attackers can exploit this vulnerability to bypass intended access restrictions. By manipulating JBIG2Decode, they can gain unauthorized access and potentially execute arbitrary code. This vulnerability poses a significant risk to systems running vulnerable versions of Ghostscript.
How To Fix
Minimum fixed version
9.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability. It is essential to update to the patched version of Ghostscript to mitigate the risk.
Conclusion
The type confusion vulnerability in Artifex Ghostscript prior to version 9.26 poses a significant risk to systems. It is crucial to update to the patched version to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows remote attackers to bypass access restrictions and potentially execute arbitrary code.
Versions of Ghostscript prior to 9.26 are affected by this vulnerability.
No, updating to the patched version is the only recommended solution.
Users should download the latest version of Ghostscript (9.26 or later) from the official Artifex Ghostscript website and follow the installation instructions provided.
For more detailed information about this vulnerability, refer to the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
