Withdrawn by the publisher.

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

ghostscript: Uninitialized memory access in the aesdecode operator (699665) ghostscript: Incorrect free logic in pagedevice replacement (699664) ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling ghostscript: User-writable error exception table ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183) ghostscript: Saved execution stacks can leak operator arrays ghostscript: 1Policy operator allows a sandbox protection bypass ghostscript: Type confusion in setpattern (700141) ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c

Affected: Ubuntu:14.04:LTS: ghostscript, Ubuntu:16.04:LTS: ghostscript, Ubuntu:18.04:LTS: ghostscript

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.