CVE-2018-19134

HIGH

Artifex Ghostscript < 9.25 - Remote Code Execution via setpattern Type Confusion

Title source: llm

Description

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

References (7)

Core 7

Core References

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:3834

Issue Tracking, Permissions Required, Third Party Advisory x_refsource_confirm

https://bugs.ghostscript.com/show_bug.cgi?id=700141

Patch x_refsource_confirm

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=693baf02152119af6e6afd30bb8ec76d14f84bbf

Exploit, Third Party Advisory x_refsource_misc

https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdf

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106278

Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/12/msg00019.html

Release Notes x_refsource_confirm

https://www.ghostscript.com/doc/9.26/News.htm

Scores

CVSS v3 7.8

EPSS 0.0287

EPSS Percentile 84.9%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-704

Status published

Products (7)

artifex/ghostscript < 9.25

debian/debian_linux 8.0

redhat/enterprise_linux_desktop 7.0

redhat/enterprise_linux_server 7.0

redhat/enterprise_linux_server_aus 7.6

redhat/enterprise_linux_server_eus 7.6

redhat/enterprise_linux_workstation 7.0

Published Dec 20, 2018

Tracked Since Feb 18, 2026