Description
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ghostscript | 9.26~dfsg-1 | — |
| Debian 13 | ghostscript | 9.26~dfsg-1 | — |
| Debian 12 | ghostscript | 9.26~dfsg-1 | — |
| Debian 9 | ghostscript | 9.26~dfsg-0+deb9u1 | DSA-4346-1 |
| Debian 8 | ghostscript | 9.06~dfsg-2+deb8u13 | DLA-1620-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.18.04.1 | — |
| Ubuntu 16.04 LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.16.04.1 | — |
| Ubuntu 14.04 LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | ghostscript +4 | 9.07-31.el7_6.6 | RHSA-2018:3834 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libgs +5 | 9.25-5.amzn2 | ALAS2-2021-1598 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | ghostscript +4 | 9.07-31.el7_6.6 | ELSA-2018-3834 |
Advisories 5
- RHSA-2018:3834 Red Hat Security Advisory: ghostscript security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4346-1 ghostscript - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1620-1 ghostscript - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2-2021-1598 Important: ghostscript security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 19, 2021
- ELSA-2018-3834 Important: ghostscript security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 18, 2018
References
- RHSA-2018:3834 vendor-advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=700141
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=693baf02152119af6e6afd30bb8ec76d14f84bbf
- https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdf
- 106278 vdb-entry
- [debian-lts-announce] 20181227 [SECURITY] [DLA 1620-1] ghostscript security update mailing-list
- https://www.ghostscript.com/doc/9.26/News.htm