In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ghostscript | Nov 27, 2019 | Nov 27, 2019 |
| Centos_linux | — | Upgrade libgs-develUpgrade ghostscript-gtkUpgrade ghostscript-x11-debuginfoUpgrade libgsUpgrade ghostscript-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-docUpgrade libgs-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript | Aug 28, 2019 | Aug 12, 2019 |
| Debian | — | Upgrade ghostscript | Aug 14, 2019 | Aug 14, 2019 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Apr 2, 2020 | Nov 27, 2019 |
| Ghostscript | — | Upgrade to Ghostscript version 9.50 | Dec 27, 2019 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Sep 28, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Feb 24, 2020 | Nov 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ghostscriptUpgrade libgs | Sep 30, 2019 | Aug 12, 2019 |
| Oracle Solaris | — | Upgrade print/filter/ghostscript-core to version 9.27-11.4.15.0.1.1.0 on Solaris 11.4Upgrade print/filter/ghostscript to version 9.27-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Nov 20, 2019 |
| Oracle_linux | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-tools-printingUpgrade libgs-develUpgrade ghostscript-docUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade ghostscript-x11 | Jul 21, 2020 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade ghostscript-cupsUpgrade ghostscript-gtkUpgrade libgs-develUpgrade ghostscript-tools-printingUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-fontsUpgrade ghostscript-debuginfoUpgrade libgsUpgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-docNo solution existsUpgrade ghostscriptUpgrade ghostscript-x11-debuginfo | Aug 13, 2019 | Aug 12, 2019 |
| Suse | — | Upgrade ghostscript-miniUpgrade ghostscript-mini-develUpgrade ghostscript-develUpgrade ghostscript-x11Upgrade ghostscript | Sep 11, 2019 | Aug 12, 2019 |
| Ubuntu | — | Upgrade libgs9Upgrade ghostscript | Aug 13, 2019 | Aug 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub