Description
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
References (12)
Scores
CVSS v3
7.8
EPSS
0.0020
EPSS Percentile
41.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-648
Status
published
Products (13)
artifex/ghostscript
< 9.27
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
canonical/ubuntu_linux
18.10
canonical/ubuntu_linux
19.04
debian/debian_linux
8.0
debian/debian_linux
9.0
fedoraproject/fedora
29
fedoraproject/fedora
30
opensuse/leap
15.0
... and 3 more
Published
May 16, 2019
Tracked Since
Feb 18, 2026