Critical Vulnerability in Ghostscript: Bypass of -dSAFER Restrictions
Summary
ALPINE-CVE-2019-14813: A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. Affects ghostscript versions < 9.27-r3. Fixed in 9.27-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is essential for applications that require document manipulation, conversion, and printing. However, Ghostscript versions prior to 9.50 have a significant security flaw that allows malicious scripts to bypass security restrictions, potentially leading to unauthorized access to the file system and execution of arbitrary commands.
Vulnerability Detail
A flaw was found in Ghostscript, specifically in the setsystemparams procedure, where it did not properly secure its privileged calls. This vulnerability enables scripts to bypass the -dSAFER restrictions, which are designed to prevent unauthorized access to the file system and execution of commands. A specially crafted PostScript file can exploit this flaw, posing serious security risks, including data breaches and system compromise.
How To Fix
Minimum fixed version
9.27-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the execution of PostScript files that are not from trusted sources. This can be done by modifying your application settings or using a sandbox environment to limit the execution context of Ghostscript.
Conclusion
The vulnerability in Ghostscript poses a significant risk due to its ability to bypass security restrictions. It is crucial for users to update to the latest patched version to mitigate potential threats. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ghostscript →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Ghostscript versions prior to 9.50 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to the file system and execution of arbitrary commands, which may result in data breaches and system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
