PT-2018-2502 · Artifex+5 · Ghostscript+5
Tavis Ormandy
·
Published
2018-10-15
·
Updated
2024-06-15
·
CVE-2018-18284
CVSS v3.1
8.6
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Artifex Ghostscript versions 9.25 and earlier
Description
The issue is related to the 1Policy procedure, which is a wrapper for the .forceput procedure in the Ghostscript software suite for document processing, conversion, and generation. It allows an attacker to bypass the secure execution environment despite the use of the -dSAFER option. This can enable a remote attacker to execute arbitrary code by exploiting the vulnerability. The exploitation involves vectors related to the 1Policy operator, which can bypass a sandbox protection mechanism.
Recommendations
For Artifex Ghostscript versions 9.25 and earlier, consider updating to a version later than 9.25 to resolve the issue. As a temporary workaround, consider restricting the use of the 1Policy operator until a patch is available. Avoid using the
1Policy operator in affected Ghostscript configurations to minimize the risk of exploitation. At the moment, there is no information about additional mitigation measures.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Ghostscript
Red Hat
Suse
Ubuntu