A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-ghostscript | Nov 8, 2019 | Sep 3, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-ghostscriptamazon-linux-ami-2-upgrade-ghostscript-cupsamazon-linux-ami-2-upgrade-ghostscript-debuginfoamazon-linux-ami-2-upgrade-ghostscript-docamazon-linux-ami-2-upgrade-ghostscript-gtkamazon-linux-ami-2-upgrade-libgsamazon-linux-ami-2-upgrade-libgs-devel | Feb 22, 2021 | Sep 3, 2019 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Sep 3, 2019 | |
| Centos_linux | — | centos-upgrade-ghostscriptcentos-upgrade-ghostscript-cupscentos-upgrade-ghostscript-debuginfocentos-upgrade-ghostscript-debugsourcecentos-upgrade-ghostscript-doccentos-upgrade-ghostscript-gtkcentos-upgrade-ghostscript-gtk-debuginfocentos-upgrade-ghostscript-x11-debuginfocentos-upgrade-libgscentos-upgrade-libgs-debuginfocentos-upgrade-libgs-devel | Sep 3, 2019 | Sep 2, 2019 |
| Debian | debian-upgrade-ghostscript | Sep 9, 2019 | Sep 3, 2019 | |
| Freebsd | freebsd-upgrade-package-ghostscript9-agpl-basefreebsd-upgrade-package-ghostscript9-agpl-x11 | Dec 10, 2019 | Dec 9, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-app-text-ghostscript-gpl | Apr 2, 2020 | Sep 3, 2019 | |
| Ghostscript | ghostscript-upgrade-9_50 | Sep 11, 2019 | Sep 3, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-ghostscripthuawei-euleros-2_0_sp2-upgrade-ghostscript-cups | Jun 17, 2020 | Sep 3, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-ghostscripthuawei-euleros-2_0_sp3-upgrade-ghostscript-cups | Nov 19, 2019 | Sep 3, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-ghostscripthuawei-euleros-2_0_sp5-upgrade-ghostscript-cups | Nov 19, 2019 | Sep 3, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-ghostscripthuawei-euleros-2_0_sp8-upgrade-libgs | Feb 26, 2020 | Sep 3, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-print-filter-ghostscript-9-27-11-4-15-0-1-1-0oracle-solaris-11-4-upgrade-print-filter-ghostscript-core-9-27-11-4-15-0-1-1-0 | Nov 20, 2019 | Sep 3, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-ghostscriptoracle-linux-upgrade-ghostscript-cupsoracle-linux-upgrade-ghostscript-docoracle-linux-upgrade-ghostscript-gtkoracle-linux-upgrade-ghostscript-tools-dvipdforacle-linux-upgrade-ghostscript-tools-fontsoracle-linux-upgrade-ghostscript-tools-printingoracle-linux-upgrade-ghostscript-x11oracle-linux-upgrade-libgsoracle-linux-upgrade-libgs-devel | Jul 21, 2020 | Aug 28, 2019 |
| Redhat_linux | redhat-upgrade-ghostscriptredhat-upgrade-ghostscript-cupsredhat-upgrade-ghostscript-debuginforedhat-upgrade-ghostscript-debugsourceredhat-upgrade-ghostscript-docredhat-upgrade-ghostscript-gtkredhat-upgrade-ghostscript-gtk-debuginforedhat-upgrade-ghostscript-tools-dvipdfredhat-upgrade-ghostscript-tools-fontsredhat-upgrade-ghostscript-tools-printingredhat-upgrade-ghostscript-x11redhat-upgrade-ghostscript-x11-debuginforedhat-upgrade-libgsredhat-upgrade-libgs-debuginforedhat-upgrade-libgs-devel | Sep 3, 2019 | Sep 2, 2019 | |
| Suse | — | suse-upgrade-ghostscriptsuse-upgrade-ghostscript-develsuse-upgrade-ghostscript-minisuse-upgrade-ghostscript-mini-develsuse-upgrade-ghostscript-x11 | Sep 28, 2019 | Aug 29, 2019 |
| Ubuntu | ubuntu-upgrade-ghostscriptubuntu-upgrade-libgs9 | Aug 30, 2019 | Aug 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub