CVE-2018-19134: Incorrect Type Cast
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
Other sources
There is a missing type check in line 292 of zcolor.c:
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l292
Here pPatInst comes from the first array element of pImpl
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l289
which comes from op:
http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=psi/zcolor.c;h=74b428801eda5c75d70cf55e88c407484b554527;hb=5a4fec2a34af925993192e197ab666fe542b79d3#l286
The type of pPatInst is not checked and is used in rptr, which accesses its pstruct value and then cast it into gspatterninstancet. As op is an untrusted argument, this can lead to type confusion issue when parsing malicious postscript. (Access to arbitrary pointer)
Upstream bug: https://bugs.ghostscript.com/showbug.cgi?id=700141
Upstream fix: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=693baf02152119af6e6afd30bb8ec76d14f84bbf
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-19134?
CVE-2018-19134 is a vulnerability in Artifex Ghostscript through 9.25 that allows a specially crafted PostScript document to execute arbitrary code or crash Ghostscript.
How can the setpattern operator in Artifex Ghostscript be exploited?
The setpattern operator in Artifex Ghostscript through 9.25 can be exploited by a specially crafted PostScript document to crash Ghostscript or execute arbitrary code in the context of the Ghostscript process.
What is the severity of CVE-2018-19134?
CVE-2018-19134 has a severity score of 7.8, indicating a high severity.
Which software versions are affected by CVE-2018-19134?
Artifex Ghostscript through 9.25 is affected by CVE-2018-19134.
How can I mitigate the vulnerability in Artifex Ghostscript?
To mitigate the vulnerability in Artifex Ghostscript, update to version 9.27~dfsg-2+deb10u5 or later.