CVE-2019-6116: High severity Artifex Ghostscript vulnerability
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
Other sources
It was found that operators did not sufficiently protect their calls to other sensitive operators. An attacker could use this flaw to get access to sensitive operators, such as .forceput, and use these operators to disable the SAFER mode, and for example, get access to the file system outside of the restricted areas.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-6116?
CVE-2019-6116 is a vulnerability in Artifex Ghostscript that allows access to system operators and can lead to remote code execution.
What is the severity of CVE-2019-6116?
CVE-2019-6116 has a severity value of 7.8, which is considered high.
Which software versions are affected by CVE-2019-6116?
The affected versions of Artifex Ghostscript are 9.27~dfsg-2+deb10u5, 9.27~dfsg-2+deb10u9, 9.53.3~dfsg-7+deb11u6, 9.53.3~dfsg-7+deb11u5, 10.0.0~dfsg-11+deb12u2, 10.0.0~dfsg-11+deb12u1, and 10.02.0~dfsg-2.
How can I fix CVE-2019-6116?
To fix CVE-2019-6116, update Artifex Ghostscript to version 9.27 or later.
Where can I find more information about CVE-2019-6116?
You can find more information about CVE-2019-6116 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00047.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00048.html), [Link 3](http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html).