Security restrictions bypass in Ghostscript and GhostXPS - CVE-2018-19475

Vulnerability identifier: #VU16071

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19475

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the psi/zdevice2.c source code file fails to check available stack space. A remote unauthenticated attacker can trick the victim into accessing a PostScript file that submits malicious input to bypass the security access restrictions on the targeted system, which could be used to conduct further attacks.

Ghostscript
GhostXPS
Debian Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Opensuse
Fedora
ghostscript (Alpine package)
ghostscript
EMC Cloud Tiering Appliance

Update to version 9.26.

Ghostscript - update to 9.26
ghostscript (Alpine package) - update to 9.26-r0
ghostscript - addressed in versions 9.26-1.fc28, 9.26-1.fc29
EMC Cloud Tiering Appliance - update to 12.1.0.65

• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3005fcb9bb160af199e761e03bc70a9f249a987e

• Multiple vulnerabilities in Artifex Ghostscript
• Debian update for ghostscript
• OpenSUSE Linux update for ghostscript
• OpenSUSE Linux update for ghostscript
• Red Hat update for ghostscript
• Security restrictions bypass in ghostscript (Alpine package)
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance Family
• Fedora 29 update for ghostscript
• Fedora 28 update for ghostscript