Improper input validation in Ghostscript - CVE-2018-15911

Vulnerability identifier: #VU14562

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15911

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the bypass of the -dSAFER option. A remote unauthenticated attacker can submit a specially crafted PostScript file, cause uninitialized memory access in the aesdecode operator and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise. 

Ghostscript
ghostscript (Alpine package)
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Ivanti Connect Secure (formerly Pulse Connect Secure)

Install update from vendor's website.

Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 8.2R12.1, 8.3R7.1, 9.0R3.4
ghostscript (Alpine package) - update to 9.24-r0

• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=8e9ce5016db968b40e4ec255a3005f2786cce45f

• Multiple vulnerabilities in Artifex Ghostscript
• Red Hat update for ghostscript
• Multiple vulnerabilities in Pulse Connect Secure and Pulse Policy Secure
• Improper input validation in ghostscript (Alpine package)