Summary
Hiroki Matsukuma discovered that the PDF interpreter in Ghostscript
did not properly restrict privileged calls when ‘-dSAFER’
restrictions were in effect. If a user or automated system were
tricked into processing a specially crafted file, a remote attacker
could possibly use this issue to access arbitrary files.
(CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.16.04.11 |
| Ubuntu · 18.04 LTS 18.04:LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.18.04.11 |
Vulnerabilities 4
-
High 7.3CVE-2019-14811 Public exploit
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not proper…
-
High 7.3
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properl…
-
High 7.3CVE-2019-14813 EPSS 11%
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly s…
-
High 7.3
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not pro…