Type confusion in ghostscript (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-19476 |
| CWE-ID | CWE-843 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
ghostscript (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Type confusion
EUVDB-ID: #VU16073
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-19476
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to a setcolorspace type confusion condition in the psi/zicc.c source code file. A remote unauthenticated attacker can trick the victim into accessing a PostScript file that submits malicious input to bypass the security access restrictions on the targeted system, which could be used to conduct further attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsghostscript (Alpine package): 9.04-r0 - 9.26-r5
ghostscript (Alpine package):
External linkshttp://git.alpinelinux.org/aports/commit/?id=b0243d03648d68851d3b5edb68da29eaae5c9f0f
http://git.alpinelinux.org/aports/commit/?id=b38a11ee1f5109ffc2f67afa52903b9437dd4111
http://git.alpinelinux.org/aports/commit/?id=1effb87543c10d5de5e0a181c6757a0d5cf9e599
http://git.alpinelinux.org/aports/commit/?id=90f284afbeec1f422dc08dc966719005e5def79a
http://git.alpinelinux.org/aports/commit/?id=e558a52ec2ce576ebfe50d2acaee3449d1ef6c26
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
