PT-2019-3235 · Artifex+5 · Ghostscript+5
Publicado
2019-08-20
·
Atualizado
2024-06-15
·
CVE-2019-14811
CVSS v3.1
7.3
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Ghostscript versions prior to 9.50
Description
A flaw in the .pdf hook DSC Creator procedure allows scripts to bypass
-dSAFER restrictions, enabling access to the file system or execution of arbitrary commands through a specially crafted PostScript file. This issue is related to insufficient access control, which can be exploited to bypass security protections.Recommendations
For Ghostscript versions prior to 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
.pdf hook DSC Creator procedure until a patch is available. Avoid using specially crafted PostScript files that could exploit this flaw.Exploit
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Ghostscript
Red Hat
Suse
Ubuntu