CVE-2019-3839: High severity ghostscript vulnerability
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
Other sources
It was found that some additional operators and dictionaries were needed to be hidden in order to prevent other CVE-2019-6116 attacks.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-3839.
What is the severity of CVE-2019-3839?
The severity of CVE-2019-3839 is high with a severity value of 7.8.
What is the affected software for CVE-2019-3839?
The affected software for CVE-2019-3839 includes Ghostscript versions up to and excluding 9.50, Debian Debian Linux 8.0 and 9.0, openSUSE Leap 15.0 and 15.1, Fedoraproject Fedora 29 and 30, and Canonical Ubuntu Linux 16.04, 18.04, 18.10, and 19.04.
How can I fix CVE-2019-3839?
To fix CVE-2019-3839, you should update Ghostscript to version 9.50 or later for Red Hat and Artifex Ghostscript, or update to the specified versions for Debian, openSUSE Leap, Fedoraproject Fedora, and Canonical Ubuntu Linux.
Where can I find more information about CVE-2019-3839?
You can find more information about CVE-2019-3839 in the provided references: [link1](http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9), [link2](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html), [link3](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html).