CVE-2019-14869: High severity Artifex Ghostscript vulnerability
A flaw was found in all versions of ghostscript 9.x before 9.50, where the .charkeys procedure, where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.
Other sources
While .charkeys cannot be called directly, it is called by .loadwofffont, which in turn can be recovered from .loadfontfile. Using a stack overflow and error handlers, .charkeys can be crashed at a convenient location and .forceput recovered from the stack.
This can be used to disable -dSAFER and, for example, access files outside of the restricted area, or command execution.
The vulnerability is not effective against ghostscript 9.50 thanks to the reimplementation of the SAFER feature.
Reference: https://bugs.ghostscript.com/showbug.cgi?id=701841
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 9.50 - Upgrade
Upgrade
ghostscriptto a version that resolves this vulnerability.Fixed in 9.50 - Compensating control
Ensure the deployed Ghostscript version is 9.50 or later, since the vulnerability is described as affecting all ghostscript 9.x versions before 9.50; until then, avoid using Ghostscript to process untrusted PostScript files because crafted files can bypass -dSAFER restrictions.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-14869.
What is the severity of CVE-2019-14869?
The severity of CVE-2019-14869 is high.
What is the affected software?
The affected software is Artifex Ghostscript version 9.x before 9.50, Fedoraproject Fedora versions 29, 30, and 31, openSUSE Leap versions 15.0 and 15.1.
How can an attacker exploit CVE-2019-14869?
An attacker can exploit CVE-2019-14869 by creating a specially crafted PostScript file that could bypass `-dSAFER` restrictions.
What is the remedy for CVE-2019-14869?
The remedy for CVE-2019-14869 is to update to version 9.50 of Artifex Ghostscript.