Description
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Scores
CVSS v3
7.8
EPSS
0.0053
EPSS Percentile
67.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-648
Status
published
Products (11)
artifex/ghostscript
< 9.50
redhat/3scale_api_management
2.6
redhat/enterprise_linux
5.0
redhat/enterprise_linux
6.0
redhat/enterprise_linux
8.0
redhat/enterprise_linux_desktop
7.0
redhat/enterprise_linux_server
7.0
redhat/enterprise_linux_server_aus
7.7
redhat/enterprise_linux_server_eus
7.7
redhat/enterprise_linux_server_tus
7.7
... and 1 more
Published
Nov 27, 2019
Tracked Since
Feb 18, 2026