CVE-2019-14812
First published: Wed Nov 27 2019(Updated: )
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Artifex Ghostscript | >=9.00<9.50 | |
| Fedoraproject Fedora | =31 | |
| debian/ghostscript | 9.27~dfsg-2+deb10u5 9.27~dfsg-2+deb10u9 9.53.3~dfsg-7+deb11u6 9.53.3~dfsg-7+deb11u5 10.0.0~dfsg-11+deb12u2 10.0.0~dfsg-11+deb12u1 10.02.0~dfsg-2 |
Remedy
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33
- https://access.redhat.com/security/cve/cve-2019-14812
- https://bugs.ghostscript.com/show_bug.cgi?id=701444
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14812
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
- https://security.gentoo.org/glsa/202004-03
- https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33
- https://www.openwall.com/lists/oss-security/2019/08/28/2
- https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=7ecbfda92b4c8dbf6f6c2bf8fc82020a29219eff
- https://security-tracker.debian.org/tracker/CVE-2019-14812
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2019-14812.
What is the severity of CVE-2019-14812?
The severity of CVE-2019-14812 is high, with a severity value of 7.8.
Which versions of ghostscript are affected by CVE-2019-14812?
All ghostscript versions 9.x before 9.50 are affected by CVE-2019-14812.
How can an attacker exploit CVE-2019-14812?
An attacker can exploit CVE-2019-14812 by using a specially crafted PostScript file to disable security protection and gain unauthorized access.
Is there a fix available for CVE-2019-14812?
Yes, a fix is available for CVE-2019-14812. It is recommended to update to ghostscript version 9.50 or later.
- collector/nvd-index
- collector/security-tracker-debian
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/author
- agent/severity
- agent/description
- agent/remedy
- agent/tags
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/artifex
- canonical/artifex ghostscript
- version/artifex ghostscript/9.00
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- package-manager/debian