Privilege Escalation in Ghostscript
Summary
CVE-2019-14813: A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. Affects ghostscript across 3 version ranges.
< 6e4664525b1db28f8c4e1130957f70a94c19213e
< 9.27-r3
< b953c0d234bc72e8489d3bf51a276c5c4ec85345
Fixed in 9.27-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. However, versions 9.x before 9.50 of Ghostscript are vulnerable to a privilege escalation issue.
Vulnerability Detail
The vulnerability, identified as CVE-2019-14813, exists in the setsystemparams procedure of Ghostscript. It fails to properly secure privileged calls, allowing scripts to bypass -dSAFER restrictions. An attacker can exploit this flaw by crafting a malicious PostScript file, which can then disable security protection and gain unauthorized access to the file system or execute arbitrary commands.
How To Fix
Minimum fixed version
9.27-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the privilege escalation vulnerability in Ghostscript can be exploited by an attacker to bypass security restrictions and gain unauthorized access to the file system or execute arbitrary commands. It is recommended to update Ghostscript to version 9.50 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to the file system or execute arbitrary commands.
To fix this vulnerability, update Ghostscript to version 9.50 or later.
No specific workaround has been provided for this vulnerability.
You can find more information about this vulnerability in the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
