Description
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
References (15)
Scores
CVSS v3
5.5
EPSS
0.0136
EPSS Percentile
80.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-648
Status
published
Products (17)
artifex/ghostscript
< 9.27
debian/debian_linux
8.0
debian/debian_linux
9.0
fedoraproject/fedora
28
fedoraproject/fedora
29
fedoraproject/fedora
30
opensuse/leap
15.0
opensuse/leap
42.3
redhat/ansible_tower
3.3
redhat/enterprise_linux
5.0
... and 7 more
Published
Mar 25, 2019
Tracked Since
Feb 18, 2026