CVE-2019-14812

High

Description

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

SeverityHigh

CVSS7.8

Exploit probability—

Product

Artifex Ghostscript

PublishedNov 27, 2019

First seenNov 27, 2019

Weakness typeCWE-648CWE-648

How to fix

Update

artifex ghostscript9.50 or later

Vendor advisories

security.gentoo.org/glsa/202004-03

Affected products

Product	Affected versions	Fixed in
artifex ghostscript	9.00 ≤ v < 9.50	9.50
fedoraproject fedora	31	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.