CVE-2018-16513

Vulnerability

A type confusion vulnerability exists in the setcolor function of Artifex Ghostscript prior to version 9.24 [1][3]. This issue occurs when processing specially crafted PostScript files, where the interpreter fails to properly validate object types, leading to undefined behavior [1][3]. All versions before 9.24 are affected [1].

Exploitation

An attacker with the ability to supply a malicious PostScript file can trigger this vulnerability by invoking the setcolor function with crafted arguments that exploit the type confusion [1][3]. No special privileges or authentication beyond the ability to deliver the file are required; the victim would need to open or process the file using a vulnerable Ghostscript instance [3].

Impact

Successful exploitation can cause a denial of service through interpreter crash [1]. The original description also notes "unspecified other impact," and subsequent references indicate that arbitrary code execution may be possible under certain conditions [1][3]. The attacker could potentially execute arbitrary code with the privileges of the process running Ghostscript [3].

Mitigation

Artifex fixed the issue in Ghostscript version 9.24, released on 2018-09-05 [1]. All users should upgrade to version 9.24 or later [1][3]. Gentoo Linux users can update to version 9.26 as recommended in GLSA 201811-12 [3]. No workaround exists for unpatched versions [3].