Ghostscript - Denial of Service Vulnerability
Summary
DLA-1363-1: ghostscript - security update. Affects ghostscript versions < 9.05~dfsg-6.3+deb7u8. Fixed in 9.05~dfsg-6.3+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF documents. The vulnerability in question affects Ghostscript's pdfwrite component, specifically the set_text_distance function in base/gdevpdts.c. This function does not properly handle text-positioning calculations, leading to potential overflows. An attacker can exploit this vulnerability by crafting a malicious PDF document, which may result in a denial of service (application crash) or other unspecified impacts.
Vulnerability Detail
The set_text_distance function in Ghostscript's pdfwrite component allows for potential overflows in text-positioning calculations. This can be exploited by an attacker through a specially crafted PDF document. The consequences of this vulnerability include a denial of service (application crash) or other unknown impacts. The vulnerability has been assigned the identifier CVE-2018-10194.
How To Fix
Minimum fixed version
9.05~dfsg-6.3+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
In conclusion, the Ghostscript package is vulnerable to a denial of service vulnerability in its pdfwrite component. Upgrading to version 9.05~dfsg-6.3+deb7u8 or later is recommended to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF documents.
The vulnerability affects the pdfwrite component of Ghostscript.
An attacker can exploit this vulnerability by crafting a malicious PDF document and tricking a user into opening it.
The vulnerability can lead to a denial of service (application crash) or other unspecified impacts.
Yes, this vulnerability has been assigned the identifier CVE-2018-10194.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
