Improper input validation in Ghostscript - CVE-2018-15908

Vulnerability identifier: #VU14565

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15908

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the bypass of the -dSAFER option. A remote unauthenticated attacker can submit a specially crafted PostScript file, bypass .tempfile restrictions and write files on the targeted system.

Ghostscript
ghostscript (Alpine package)
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power

Install update from vendor's website.

ghostscript (Alpine package) - update to 9.24-r0

• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0d3901189f245232f0161addf215d7268c4d05a3

• Multiple vulnerabilities in Artifex Ghostscript
• Red Hat update for Artifex Ghostscript
• Improper input validation in ghostscript (Alpine package)