PT-2019-3233 · Artifex+5 · Ghostscript+5
Cedric Buissart
·
Publicado
2019-08-02
·
Atualizado
2024-06-15
·
CVE-2019-10216
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ghostscript versions prior to 9.50
Description
The issue is related to the .buildfont1 procedure in Ghostscript, which did not properly secure its privileged calls, allowing scripts to bypass
-dSAFER restrictions. An attacker could exploit this flaw by creating a specially crafted PostScript file to escalate privileges and access files outside of restricted areas. This could potentially be used to execute arbitrary code in the system.Recommendations
For Ghostscript versions prior to 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the .buildfont1 procedure until a patch is available. Avoid processing specially crafted PostScript files that could exploit this vulnerability.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Ghostscript
Red Hat
Suse
Ubuntu