CVE-2019-14869

HIGH

Ghostscript 9.x <9.50 - Privilege Escalation

Title source: llm
STIX 2.1

Description

A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.

Scores

CVSS v3 8.8
EPSS 0.0027
EPSS Percentile 50.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-648 CWE-732
Status published
Products (6)
artifex/ghostscript 9.00 - 9.50
fedoraproject/fedora 29
fedoraproject/fedora 30
fedoraproject/fedora 31
opensuse/leap 15.0
opensuse/leap 15.1
Published Nov 15, 2019
Tracked Since Feb 18, 2026