Critical Vulnerability in Ghostscript: Bypass of -dSAFER Restrictions
Summary
ALPINE-CVE-2019-14811: A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. Affects ghostscript versions < 9.27-r3. Fixed in 9.27-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is integral to many applications that require document manipulation, conversion, and printing. However, Ghostscript versions prior to 9.50 are vulnerable to a security flaw that allows unauthorized access to the file system and execution of arbitrary commands, compromising the integrity and security of the system.
Vulnerability Detail
A flaw was found in Ghostscript versions prior to 9.50, specifically in the .pdf_hook_DSC_Creator procedure. This flaw does not properly secure its privileged calls, enabling scripts to bypass the -dSAFER restrictions. A specially crafted PostScript file can disable security protections, allowing access to the file system or the execution of arbitrary commands. This vulnerability poses significant risks, including data breaches and unauthorized system control.
How To Fix
Minimum fixed version
9.27-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted PostScript files until the package is updated. Implement strict file validation and sanitization to mitigate potential risks.
Conclusion
The vulnerability in Ghostscript poses a significant risk to systems that utilize this software for document processing. It is crucial to update to the patched version to mitigate potential threats. Users should remain vigilant and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for ghostscript →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
All Ghostscript versions prior to 9.50 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to the file system and the ability to execute arbitrary commands, leading to data breaches and system compromise.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
