Type confusion in Ghostscript and GhostXPS - CVE-2018-19476

Vulnerability identifier: #VU16073

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19476

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to a setcolorspace type confusion condition in the psi/zicc.c source code file. A remote unauthenticated attacker can trick the victim into accessing a PostScript file that submits malicious input to bypass the security access restrictions on the targeted system, which could be used to conduct further attacks.

Ghostscript
GhostXPS
Debian Linux
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Opensuse
Fedora
ghostscript (Alpine package)
ghostscript
EMC Cloud Tiering Appliance

Update to version 9.26.

Ghostscript - update to 9.26
ghostscript (Alpine package) - update to 9.26-r0
ghostscript - addressed in versions 9.26-1.fc28, 9.26-1.fc29
EMC Cloud Tiering Appliance - update to 12.1.0.65

• http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=67d760ab775dae4efe803b5944b0439aa3c0b04a

• Multiple vulnerabilities in Artifex Ghostscript
• Debian update for ghostscript
• OpenSUSE Linux update for ghostscript
• OpenSUSE Linux update for ghostscript
• Red Hat update for ghostscript
• Type confusion in ghostscript (Alpine package)
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance Family
• Fedora 29 update for ghostscript
• Fedora 28 update for ghostscript