Vulnerability identifier: #VU46585
Vulnerability risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Ghostscript
Universal components / Libraries /
Libraries used by multiple products
Vendor: Artifex Software, Inc.
Description
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a denial of service.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Ghostscript: 9.25
External links
http://bugs.ghostscript.com/show_bug.cgi?id=702851
http://bugzilla.redhat.com/show_bug.cgi?id=1873239
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ece5cbbd9979cd35737b00e68267762d72feb2ea;hp=1ef5f08f2c2e27efa978f0010669ff22355c385f
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.