Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ghostscript: CVE-2019-14869

Related Vulnerabilities: CVE-2019-14869  

Source

Debian Bug report logs - #944760
ghostscript: CVE-2019-14869

version graph

Package: src:ghostscript; Maintainer for src:ghostscript is Debian Printing Team <debian-printing@lists.debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Thu, 14 Nov 2019 21:51:02 UTC

Severity: grave

Tags: security, upstream

Found in versions ghostscript/9.27~dfsg-1, ghostscript/9.26a~dfsg-0+deb9u1, ghostscript/9.27~dfsg-3.1, ghostscript/9.26a~dfsg-0+deb9u5, ghostscript/9.50~dfsg-2, ghostscript/9.27~dfsg-2+deb10u2

Fixed in versions ghostscript/9.26a~dfsg-0+deb9u6, ghostscript/9.27~dfsg-2+deb10u3

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian Printing Team <debian-printing@lists.debian.org>:
Bug#944760; Package src:ghostscript. (Thu, 14 Nov 2019 21:51:05 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian Printing Team <debian-printing@lists.debian.org>. (Thu, 14 Nov 2019 21:51:05 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: ghostscript: CVE-2019-14869
Date: Thu, 14 Nov 2019 22:47:49 +0100
Source: ghostscript
Version: 9.50~dfsg-2
Severity: grave
Tags: security upstream
Control: found -1 9.26a~dfsg-0+deb9u5
Control: found -1 9.26a~dfsg-0+deb9u1
Control: found -1 9.27~dfsg-2+deb10u2
Control: found -1 9.27~dfsg-1
Control: found -1 9.27~dfsg-3.1
Control: fixed -1 9.26a~dfsg-0+deb9u6
Control: fixed -1 9.27~dfsg-2+deb10u3

Hi,

The following vulnerability was published for ghostscript. I can agree
the severity is not exaclty matching, as for 9.50 itself, it's not
anymore directly exploitable (unless with -dOLDSAFER). Still it cannot
be considred fixed, only after applying [1].

CVE-2019-14869[0]:
|-dSAFER escape in .charkeys

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-14869
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14869
[1] https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f0aa1140032746e5a0abf
[2] https://bugs.ghostscript.com/show_bug.cgi?id=701841

Regards,
Salvatore

Marked as found in versions ghostscript/9.26a~dfsg-0+deb9u5. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:05 GMT) (full text, mbox, link).

Marked as found in versions ghostscript/9.26a~dfsg-0+deb9u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:05 GMT) (full text, mbox, link).

Marked as found in versions ghostscript/9.27~dfsg-2+deb10u2. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:06 GMT) (full text, mbox, link).

Marked as found in versions ghostscript/9.27~dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:06 GMT) (full text, mbox, link).

Marked as found in versions ghostscript/9.27~dfsg-3.1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:07 GMT) (full text, mbox, link).

Marked as fixed in versions ghostscript/9.26a~dfsg-0+deb9u6. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:08 GMT) (full text, mbox, link).

Marked as fixed in versions ghostscript/9.27~dfsg-2+deb10u3. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Thu, 14 Nov 2019 21:51:09 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Nov 15 08:34:40 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started