Security restrictions bypass in Ghostscript and GhostXPS - CVE-2018-18073

Vulnerability identifier: #VU15748

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-18073

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to exposure of system operators in the saved execution stack in an error object. A remote attacker can bypass a sandbox protection mechanism to conduct further attacks.

Ghostscript
GhostXPS
Debian Linux
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
Fedora
ghostscript (Alpine package)
ghostscript
EMC Cloud Tiering Appliance

Install update from vendor's website.

ghostscript (Alpine package) - update to 9.25-r1
ghostscript - addressed in versions 9.26-1.fc28, 9.26-1.fc29
EMC Cloud Tiering Appliance - update to 12.1.0.65

• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=34cc326eb2c5695833361887fe0b32e8d987741c

• Arch Linux update for ghostscript
• Debian update for ghostscript
• OpenSUSE Linux update for ghostscript
• OpenSUSE Linux update for ghostscript
• Red Hat update for ghostscript
• Security restrictions bypass in ghostscript (Alpine package)
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance Family
• Fedora 29 update for ghostscript
• Fedora 28 update for ghostscript