Improper input validation in ghostscript (Alpine package)

1) Improper input validation

EUVDB-ID: #VU14562

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-15911

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the bypass of the -dSAFER option. A remote unauthenticated attacker can submit a specially crafted PostScript file, cause uninitialized memory access in the aesdecode operator and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise. 

Mitigation

Install update from vendor's website.

Vulnerable software versions

ghostscript (Alpine package): 8.70-r0 - 9.22-r0

ghostscript (Alpine package):

CPE2.3

• cpe:2.3:o:alpine:ghostscript_alpine_package:8.70-r0:*:*:*:*:alpine_linux:*:1.9
• cpe:2.3:o:alpine:ghostscript_alpine_package:9.04-r0:*:*:*:*:alpine_linux:*:2.3
• cpe:2.3:o:alpine:ghostscript_alpine_package:9.06-r0:*:*:*:*:alpine_linux:*:2.2
• cpe:2.3:o:alpine:ghostscript_alpine_package::*:*:*:*:alpine_linux:*:*

External links

https://git.alpinelinux.org/aports/commit/?id=0c81d393f55e12aad1694ac3ee4ed2b865527f6f
https://git.alpinelinux.org/aports/commit/?id=5e753b12c86f19cc249a631482ee1a4a739e45aa
https://git.alpinelinux.org/aports/commit/?id=646b9a7b6b94e05cb166f6a084a22fe8f03264fb
https://git.alpinelinux.org/aports/commit/?id=c13758613f3110e14c2e9eda818406f235d996c1
https://git.alpinelinux.org/aports/commit/?id=dd646650fecf6b0d42ffc26eed4a6da53a6040e5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.