PT-2019-3237 · Artifex+5 · Ghostscript+5

Published 2019-08-20 · Updated 2020-10-25 · CVE-2019-14813

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ghostscript versions 9.x before 9.50

Description A flaw in the setsystemparams procedure of ghostscript enables scripts to bypass -dSAFER restrictions. This allows a specially crafted PostScript file to disable security protection, potentially granting access to the file system or enabling the execution of arbitrary commands.

Recommendations For ghostscript versions 9.x before 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the setsystemparams procedure until a patch is available. Avoid using the setsystemparams procedure in sensitive environments until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-648

CWE-863

CWE-264

Related Identifiers

ALT-PU-2019-2669

ALT-PU-2020-2917

ALT-PU-2020-2921

ALT-PU-2020-3124

BDU:2019-03227

CESA-2019_2586

CESA-2019_2591

CVE-2019-14813

DLA-1915-1

DSA-4518-1

MGASA-2019-0271

OPENSUSE-SU-2019:2222-1

OPENSUSE-SU-2019:2223-1

OPENSUSE-SU-2019_2222-1

OPENSUSE-SU-2019_2223-1

RHSA-2019:2586

RHSA-2019:2591

RHSA-2019_2586

RHSA-2019_2591

SUSE-SU-2019:2460-1

SUSE-SU-2019:2478-1

USN-4111-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Ghostscript

References · 64

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813 · Patch
• https://debian.org/security/2019/dsa-4518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14811 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14813 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2460-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14813 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1915-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14813 · Vendor Advisory
• https://security.gentoo.org/glsa/202004-03 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0271 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:2824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14812 · Vendor Advisory