PT-2019-3237 · Artifex+5 · Ghostscript+5

Publicado 2019-08-20 · Atualizado 2020-10-25 · CVE-2019-14813

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ghostscript versions 9.x before 9.50

Description A flaw in the setsystemparams procedure of ghostscript enables scripts to bypass -dSAFER restrictions. This allows a specially crafted PostScript file to disable security protection, potentially granting access to the file system or enabling the execution of arbitrary commands.

Recommendations For ghostscript versions 9.x before 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the setsystemparams procedure until a patch is available. Avoid using the setsystemparams procedure in sensitive environments until the issue is resolved.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-648

CWE-863

CWE-264

Identificadores relacionados

ALT-PU-2019-2669

ALT-PU-2020-2917

ALT-PU-2020-2921

ALT-PU-2020-3124

BDU:2019-03227

CESA-2019_2586

CESA-2019_2591

CVE-2019-14813

DLA-1915-1

DSA-4518-1

MGASA-2019-0271

OPENSUSE-SU-2019:2222-1

OPENSUSE-SU-2019:2223-1

OPENSUSE-SU-2019_2222-1

OPENSUSE-SU-2019_2223-1

RHSA-2019:2586

RHSA-2019:2591

RHSA-2019_2586

RHSA-2019_2591

SUSE-SU-2019:2460-1

SUSE-SU-2019:2478-1

USN-4111-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Ghostscript

Referências · 64

• https://bugzilla.suse.com/1140359 · Nota
• https://suse.com/security/cve/CVE-2019-14813 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20192460-1 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813 · Correção
• https://debian.org/security/2019/dsa-4518 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14811 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-14813 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:2460-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-14813 · Aviso do Fabricante
• https://usn.ubuntu.com/4111-1 · Nota
• https://osv.dev/vulnerability/DLA-1915-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-14812 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14813 · Aviso do Fabricante