CVE-2018-19409 Security feature bypass in n/a

Critical 9.8 Published 21 Nov 2018 Updated 5 Aug 2024

Attackers can bypass Ghostscript's LockSafetyParams security feature by using an alternate device, potentially enabling further exploitation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-19409?

CVE-2018-19409 is a critical vulnerability in Artifex Ghostscript, published on 21 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.

Which versions are affected by CVE-2018-19409?

It affects 8 products.

Products include Artifex Ghostscript, Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.

How do I fix CVE-2018-19409?

Upgrade to a fixed version.

Is CVE-2018-19409 being exploited?

There is no known exploitation of CVE-2018-19409 in the wild and no public exploit code.

All Artifex Ghostscript vulnerabilities

Sources

Also known as ALPINE-CVE-2018-19409, DEBIAN-CVE-2018-19409, GHSA-xr7x-hc9m-fv57, UBUNTU-CVE-2018-19409.