Ghostscript GhostXPS CVE-2017-9618 Denial of Service Vulnerability

Bugtraq ID:	99993
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-9618
Remote:	Yes
Local:	No
Published:	Jul 26 2017 12:00AM
Updated:	Jul 26 2017 12:00AM
Credit:	Kim Gwan Yeong
Vulnerable:	Artifex Ghostscript 9.22
Not Vulnerable:

Ghostscript GhostXPS CVE-2017-9618 Denial of Service Vulnerability

Ghostscript GhostXPS is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, code execution may be possible but this has not been confirmed.

Ghostscript GhostXPS 9.22 is vulnerable; other versions may also be affected.

Ghostscript GhostXPS CVE-2017-9618 Denial of Service Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Ghostscript GhostXPS CVE-2017-9618 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ghostscript GhostXPS CVE-2017-9618 Denial of Service Vulnerability

References:

• Bug 1475827 - (CVE-2017-9618) CVE-2017-9618 ghostscript: Buffer overflow in the (Red Hat)
  
• Bug 698044 - memcpy-param-overlap in xps_load_sfnt_name(xps/xpsfont.c) (Ghostscript)
  
• CVE-2017-9618 (Red Hat)
  
• GhostXPS Homepage (Ghostscript)
  
• projects / ghostpdl.git / commitdiff (Ghostscript)