Published: 21/03/2019 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

In Artifex Ghostscript up to and including 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
artifex ghostscript
fedoraproject fedora 28
fedoraproject fedora 29
fedoraproject fedora 30
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
debian debian linux 8.0
debian debian linux 9.0
opensuse leap 42.3
opensuse leap 15.0
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6

Ghostscript could be made to crash, access files, or run programs if it opened a specially crafted file ...

Synopsis Important: ghostscript security update Type/Severity Security Advisory: Important Topic An update for ghostscript is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: ghostscript security update Type/Severity Security Advisory: Important Topic An update for ghostscript is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: ghostscript security and bug fix update Type/Severity Security Advisory: Important Topic An update for ghostscript is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Syste ...

Artifex Ghostscript before 925 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (CVE-2018-17183) Artifex Ghostscript 925 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involv ...

Impact: Important Public Date: 2019-01-23 Bugzilla: 1666636: CVE-2019-6116 ghostscript: subroutines with ...

It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system and execute commands ...

I noticed ghostscript 926 was released, so had a quick look and spotted some errors For background, this is how you define a subroutine in postscript: /hello { (hello\n) print } def That's simple enough, but because a subroutine is just an executable array of commands, you need to mark it as executeonly if you're using system operators Tha ...

NVD-CWE-noinfo https://www.exploit-db.com/exploits/46242/https://www.debian.org/security/2019/dsa-4372 https://usn.ubuntu.com/3866-1/https://lists.debian.org/debian-lts-announce/2019/02/msg00016.html https://bugs.ghostscript.com/show_bug.cgi?id=700317 https://bugs.chromium.org/p/project-zero/issues/detail?id=1729 https://access.redhat.com/errata/RHSA-2019:0229 http://www.securityfocus.com/bid/106700 http://www.openwall.com/lists/oss-security/2019/01/23/5 http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00048.html http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00047.html http://www.openwall.com/lists/oss-security/2019/03/21/1 https://seclists.org/bugtraq/2019/Apr/4 http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html https://access.redhat.com/errata/RHBA-2019:0327 https://security.gentoo.org/glsa/202004-03 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWVAVCDXBLPLJMVGNSKGGDTBEOHCJBKK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N6T5L3SSJX2AVUPHP7GCPATFWUPKZT2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVWXVKG72IGEJYHLWE6H3CGALHGFSGGY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/https://usn.ubuntu.com/3866-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/46242

CVE-2019-6116

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect