CVE-2018-16539

Vulnerability

In Artifex Ghostscript before version 9.24, the handling of temporary files in the PostScript interpreter contains an incorrect access check vulnerability. An attacker who can supply a crafted PostScript file can leverage this flaw to read files on the system that would otherwise be inaccessible. [1][2]

Exploitation

An attacker must be able to provide a specially crafted PostScript file to a Ghostscript interpreter. No additional authentication or network position is required if the user processes the file. The exploit involves triggering the temp file handling code path with the malicious input, bypassing intended access restrictions.

Impact

Successful exploitation leads to disclosure of arbitrary file contents on the system, compromising confidentiality. The attacker gains read access to files that are not normally readable, potentially including sensitive data.

Mitigation

The vulnerability is fixed in Ghostscript version 9.24. Red Hat Enterprise Linux 7 shipped a patched version 9.07-31.el7_6.1 [1]. Ubuntu 18.04 LTS received package version 9.22~dfsg+1-0ubuntu1.2 [2]. Users should update to the latest patched version for their distribution. No workaround is provided.