Improper input validation in Ghostscript - CVE-2018-15909

Vulnerability identifier: #VU14496

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15909

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions and execute arbitrary system commands.

The vulnerability exists due to improper input validation when processing malformed PostScript, PDF, EPS, or XPS files. A remote attacker can supply a specially crafted file, bypass -dSAFER restrictions and execute arbitrary commands on vulnerable system.

Ghostscript
ghostscript (Alpine package)
ghostscript
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power
Fedora
Ivanti Connect Secure (formerly Pulse Connect Secure)

Install update from vendor's website.

Ghostscript - update to 9.24
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 8.2R12.1, 8.3R7.1, 9.0R3.4
ghostscript (Alpine package) - update to 9.24-r0
ghostscript - addressed in versions 9.23-6.fc28, 9.23-7.fc29

• https://www.kb.cert.org/vuls/id/332928
• http://openwall.com/lists/oss-security/2018/08/21/2
• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0b6cd1918e1ec4ffd087400a754a845180a4522b
• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6

• Remote command execution in Ghostscript
• Red Hat update for Artifex Ghostscript
• Multiple vulnerabilities in Pulse Connect Secure and Pulse Policy Secure
• Improper input validation in ghostscript (Alpine package)
• Fedora 28 update for ghostscript
• Fedora 29 update for ghostscript