Red Hat update for Artifex Ghostscript

1) Improper input validation

EUVDB-ID: #VU14565

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-15908

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the bypass of the -dSAFER option. A remote unauthenticated attacker can submit a specially crafted PostScript file, bypass .tempfile restrictions and write files on the targeted system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM z Systems: 7 - 7.6

Red Hat Enterprise Linux for Power: 7.6 - 9

Red Hat Enterprise Linux Server: 7 - 7.6

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

External links

http://access.redhat.com/errata/RHSA-2018:3650

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU14496

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-15909

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions and execute arbitrary system commands.

The vulnerability exists due to improper input validation when processing malformed PostScript, PDF, EPS, or XPS files. A remote attacker can supply a specially crafted file, bypass -dSAFER restrictions and execute arbitrary commands on vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM z Systems: 7 - 7.6

Red Hat Enterprise Linux for Power: 7.6 - 9

Red Hat Enterprise Linux Server: 7 - 7.6

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

External links

http://access.redhat.com/errata/RHSA-2018:3650

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Type confusion

EUVDB-ID: #VU14688

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-16511

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to a type confusion condition in the ztype code. A remote unauthenticated attacker can trick the victim into opening a specially crafted PostScript file that submits malicious input and cause the affected software to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM z Systems: 7 - 7.6

Red Hat Enterprise Linux for Power: 7.6 - 9

Red Hat Enterprise Linux Server: 7 - 7.6

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

External links

http://access.redhat.com/errata/RHSA-2018:3650

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Improper access control

EUVDB-ID: #VU14733

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16539

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to an improper access restrictions when processing PostScript files within the temp directory. A remote attacker can create a specially crafted PostScript file and use it to read arbitrary files on the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM z Systems: 7 - 7.6

Red Hat Enterprise Linux for Power: 7.6 - 9

Red Hat Enterprise Linux Server: 7 - 7.6

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

External links

http://access.redhat.com/errata/RHSA-2018:3650

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.