CVE-2018-17961

Ghostscript is the component many systems use to render PDFs and other document formats. This bug can let a malicious file “trick” Ghostscript into ignoring its built-in safety fence, so the attacker can run harmful actions on the same computer once a user opens the file. Think of it like a locked gate that can be bypassed if someone sets up the wrong “door controller” and persuades an employee to walk through.

This matters if your business uses or installs Artifex Ghostscript, or if your systems automatically open/process PDFs and similar files using Ghostscript (including on Ubuntu, Debian, Astra Linux, and Red Hat Enterprise Linux). It’s mainly a risk when an attacker already has local access to the machine and can get a user to open a crafted file. If attackers cannot reach the machine locally or cannot cause user interaction, the risk is much lower.

Treat this as urgent but not emergency-wide: it’s a high-severity sandbox-bypass that can lead to severe compromise, and it does have at least one public exploit. However, it requires a local attacker plus a user opening a crafted file, so the practical exposure depends on how your devices handle documents and who has access to them. Follow through quickly—do not leave systems on Ghostscript 9.25 or earlier.

1. Confirm installed version and whether Ghostscript is present

   • On Ubuntu/Debian/RHEL/Astra Linux, check the installed package version (e.g., via your package manager).
   • Record the current Ghostscript version across desktops/servers that process documents.

2. Determine exposure

   • This CVE affects Ghostscript versions 9.25 and earlier.
   • If you find 9.25 or earlier, you should upgrade.

3. Upgrade to the fixed version

   • Fix is available starting at Ghostscript 9.25 (upgrade to a version at/above the fixed release as provided by your distribution).
   • For Ubuntu, follow the vendor security update guidance: https://usn.ubuntu.com/3803-1/
   • For other distros, use their corresponding Ghostscript package updates (vendor pointers are included in the findings).

4. If you cannot patch immediately (temporary risk reduction)

   • Reduce the chance a user opens untrusted files on affected machines (limit access to document upload sources, add caution/workflow controls for unexpected PDFs/images).
   • Ensure local access to workstations/servers is tightly controlled (because the scenario assumes a local attacker who can induce user interaction).

5. After upgrading

   • Re-run your normal document rendering/printing workflow to ensure nothing breaks.
   • Verify the installed Ghostscript version now matches the patched state via your package manager.

6. What to monitor

   • Look for signs of suspicious activity on systems where Ghostscript is used to process documents (especially around times users opened received attachments).

Severity: high (CVSS score shown as 8.6). Weakness type: CWE-209 (information exposure / incomplete fix style issues in the broader class; here it manifests as sandbox bypass via error-handler manipulation). Mechanism: Ghostscript’s sandbox protection can be bypassed by manipulating error handling (errorhandler setup), which allows unauthorized code execution after a crafted file causes victim interaction. Conditions from findings: local attacker with local access plus user interaction required; authentication required: none (for exploitation attempt itself), but the attacker must still be able to reach the system locally and induce opening the crafted file. Exploitation status: public exploit is available; KEV listing is not present. Patch status: fixed in Ghostscript 9.25; references indicate this is tied to an incomplete fix for CVE-2018-17183. EPSS is provided in the findings as predicted likelihood (do not treat as proof of active exploitation). Traffic-light verdict: AMBER, aligning with meaningful exploitability but constrained by local+user-interaction prerequisites.