Debian update for ghostscript



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-11645
CVE-2018-17961
CVE-2018-18073
CVE-2018-18284
CWE-ID CWE-200
CWE-94
CWE-264
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
 Debian Linux
Operating systems & Components / Operating system

Vendor Debian

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU13177

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11645

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists in the psi/zfile.c code of Artifex Software Ghostscript due to improper security restrictions. A remote attacker can trick the victim into opening a specially crafted file that submits malicious input and access sensitive information, such as the existence and size of files. 

Mitigation

Update the affected package to version: 9.25~dfsg-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.debian.org/security/2018/dsa-4336


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU15376

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2018-17961

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation that allows sandbox bypass via error handler setup vectors. A remote attacker can pass a specially crafted PostScript file to the affected application, inject and execute arbitrary code on the target system.

Note: this vulnerability exists due to insufficient patch for previously fixed Code injection vulnerability (CVE-2018-17183).

Mitigation

Update the affected package to version: 9.25~dfsg-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.debian.org/security/2018/dsa-4336


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Security restrictions bypass

EUVDB-ID: #VU15748

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-18073

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to exposure of system operators in the saved execution stack in an error object. A remote attacker can bypass a sandbox protection mechanism to conduct further attacks.

Mitigation

Update the affected package to version: 9.25~dfsg-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.debian.org/security/2018/dsa-4336


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Code injection

EUVDB-ID: #VU15463

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2018-18284

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass the sandbox protection mechanism on the target system.

The vulnerability exists due to the failure of the sandbox protection mechanism of the affected software when the 1Policy operator is used. A remote unauthenticated attacker can trick the victim into accessing a PostScript file that submits malicious input, bypass the sandbox protection mechanism and modify or replace error handlers used by the software, which the attacker could use to inject and execute arbitrary code on the system.

Mitigation

Update the affected package to version: 9.25~dfsg-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.debian.org/security/2018/dsa-4336


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###