CVE-2018-19476

Vulnerability

CVE-2018-19476 is a type confusion vulnerability in the setcolorspace operator within psi/zicc.c of Artifex Ghostscript versions before 9.26. An attacker can craft a PostScript or PDF file that triggers this type confusion, causing the interpreter to treat a color space object as another type, thereby bypassing the intended input validation and access controls. The flaw is reachable when Ghostscript processes untrusted input, such as during document conversion or thumbnail generation in applications that rely on Ghostscript [1][3].

Exploitation

Exploitation requires an attacker to supply a specially crafted PostScript or PDF file to a target using an affected version of Ghostscript. No special authentication or network position is needed beyond the ability to deliver the file (e.g., via email, web upload, or system print queue). The type confusion in the setcolorspace function allows the attacker to escape the normal execution sandbox and execute arbitrary operations [1][4]. The vulnerability can be triggered without any explicit user interaction other than Ghostscript processing the malicious document [3].

Impact

Successful exploitation enables a remote attacker to bypass Ghostscript's built-in access restrictions, potentially leading to arbitrary file read, file write, or remote code execution under the privileges of the Ghostscript process. This can compromise the confidentiality, integrity, and availability of the affected system. The impact is similar to other Ghostscript sandbox escapes, allowing an attacker to run arbitrary shell commands [1][3][4].

Mitigation

The vulnerability is fixed in Ghostscript version 9.26. Red Hat released updates for Red Hat Enterprise Linux 7 (ghostscript-9.07-31.el7_6.9) on 2019-02-12 [1]. Canonical released updates for Ubuntu via USN-3831-1 on 2018-11-29 [3]. Users should update Ghostscript to the latest version or apply the vendor-supplied patches. As a workaround, disable processing of untrusted PostScript and PDF files or use a policy file to restrict unsafe operations.