It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ghostscript-debuginfoUpgrade libgs-develUpgrade libgsUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade ghostscript-docUpgrade ghostscript-gtk | Feb 22, 2021 | May 16, 2019 |
| Centos_linux | — | Upgrade ghostscript-develUpgrade ghostscript-x11-debuginfoUpgrade libgsUpgrade ghostscript-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript-debugsourceUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-docUpgrade ghostscript-gtkUpgrade ghostscript | May 15, 2019 | May 8, 2019 |
| Debian | — | Upgrade ghostscript | May 13, 2019 | May 13, 2019 |
| Ghostscript | — | Upgrade to Ghostscript version 9.27 | Jun 12, 2019 | May 16, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Jul 23, 2019 | May 16, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Sep 25, 2019 | May 16, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscript-cupsUpgrade ghostscript | May 30, 2019 | May 16, 2019 |
| Oracle Solaris | — | Upgrade print/filter/ghostscript-core to version 9.27-11.4.13.0.1.3.0 on Solaris 11.4Upgrade print/filter/ghostscript to version 9.27-11.4.13.0.1.3.0 on Solaris 11.4 | Sep 17, 2019 | May 16, 2019 |
| Oracle_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-tools-fontsUpgrade ghostscript-develUpgrade libgs-develUpgrade libgsUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-tools-dvipdf | Jul 21, 2020 | May 2, 2019 |
| Redhat_linux | — | Upgrade ghostscript-docUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscriptUpgrade libgs-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-develUpgrade ghostscript-tools-fontsUpgrade ghostscript-cupsUpgrade ghostscript-debugsourceUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11No solution existsUpgrade ghostscript-debuginfoUpgrade ghostscript-gtkUpgrade libgs-develUpgrade libgs | May 8, 2019 | May 7, 2019 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-mini-develUpgrade ghostscript-miniUpgrade ghostscript-x11Upgrade ghostscript-devel | Sep 27, 2019 | May 8, 2019 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libgs9 | May 9, 2019 | May 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub