Vulnerabilites related to Artifex Software - ghostscript
cve-2019-14817
Vulnerability from cvelistv5
Published
2019-09-03 15:50
Modified
2024-08-05 00:26
Severity ?
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817x_refsource_CONFIRM
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=cd1b1cacadac2479e291efe611979bdc1b3bdb19x_refsource_CONFIRM
https://www.debian.org/security/2019/dsa-4518vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2019/09/msg00007.htmlmailing-list, x_refsource_MLIST
https://seclists.org/bugtraq/2019/Sep/15mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2019:2594vendor-advisory, x_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHBA-2019:2824vendor-advisory, x_refsource_REDHAT
https://security.gentoo.org/glsa/202004-03vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Artifex Software ghostscript Version: ghostscript versions prior to 9.28
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.156Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=cd1b1cacadac2479e291efe611979bdc1b3bdb19",
               },
               {
                  name: "DSA-4518",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2019/dsa-4518",
               },
               {
                  name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
               },
               {
                  name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/15",
               },
               {
                  name: "RHSA-2019:2594",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2594",
               },
               {
                  name: "FEDORA-2019-0a9d525d71",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
               },
               {
                  name: "FEDORA-2019-953fc0f16d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
               },
               {
                  name: "FEDORA-2019-ebd6c4f15a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
               },
               {
                  name: "openSUSE-SU-2019:2222",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
               },
               {
                  name: "openSUSE-SU-2019:2223",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
               },
               {
                  name: "RHBA-2019:2824",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHBA-2019:2824",
               },
               {
                  name: "GLSA-202004-03",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202004-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ghostscript",
               vendor: "Artifex Software",
               versions: [
                  {
                     status: "affected",
                     version: "ghostscript versions prior to 9.28",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-648",
                     description: "CWE-648",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-04-01T21:06:06",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=cd1b1cacadac2479e291efe611979bdc1b3bdb19",
            },
            {
               name: "DSA-4518",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2019/dsa-4518",
            },
            {
               name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
            },
            {
               name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/15",
            },
            {
               name: "RHSA-2019:2594",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2594",
            },
            {
               name: "FEDORA-2019-0a9d525d71",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
            },
            {
               name: "FEDORA-2019-953fc0f16d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
            },
            {
               name: "FEDORA-2019-ebd6c4f15a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
            },
            {
               name: "openSUSE-SU-2019:2222",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
            },
            {
               name: "openSUSE-SU-2019:2223",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
            },
            {
               name: "RHBA-2019:2824",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHBA-2019:2824",
            },
            {
               name: "GLSA-202004-03",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202004-03",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14817",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ghostscript",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "ghostscript versions prior to 9.28",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Artifex Software",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-648",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817",
                  },
                  {
                     name: "http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19",
                     refsource: "CONFIRM",
                     url: "http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19",
                  },
                  {
                     name: "DSA-4518",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2019/dsa-4518",
                  },
                  {
                     name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
                  },
                  {
                     name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/15",
                  },
                  {
                     name: "RHSA-2019:2594",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2594",
                  },
                  {
                     name: "FEDORA-2019-0a9d525d71",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
                  },
                  {
                     name: "FEDORA-2019-953fc0f16d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
                  },
                  {
                     name: "FEDORA-2019-ebd6c4f15a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
                  },
                  {
                     name: "openSUSE-SU-2019:2222",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
                  },
                  {
                     name: "openSUSE-SU-2019:2223",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
                  },
                  {
                     name: "RHBA-2019:2824",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHBA-2019:2824",
                  },
                  {
                     name: "GLSA-202004-03",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202004-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14817",
      datePublished: "2019-09-03T15:50:42",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.156Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14811
Vulnerability from cvelistv5
Published
2019-09-03 15:17
Modified
2024-08-05 00:26
Severity ?
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811x_refsource_CONFIRM
https://www.debian.org/security/2019/dsa-4518vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2019/09/msg00007.htmlmailing-list, x_refsource_MLIST
https://seclists.org/bugtraq/2019/Sep/15mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2019:2594vendor-advisory, x_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHBA-2019:2824vendor-advisory, x_refsource_REDHAT
https://security.gentoo.org/glsa/202004-03vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Artifex Software ghostscript Version: ghostscript versions prior to 9.28
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:38.930Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
               },
               {
                  name: "DSA-4518",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2019/dsa-4518",
               },
               {
                  name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
               },
               {
                  name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/15",
               },
               {
                  name: "RHSA-2019:2594",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2594",
               },
               {
                  name: "FEDORA-2019-0a9d525d71",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
               },
               {
                  name: "FEDORA-2019-953fc0f16d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
               },
               {
                  name: "FEDORA-2019-ebd6c4f15a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
               },
               {
                  name: "openSUSE-SU-2019:2222",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
               },
               {
                  name: "openSUSE-SU-2019:2223",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
               },
               {
                  name: "RHBA-2019:2824",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHBA-2019:2824",
               },
               {
                  name: "GLSA-202004-03",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202004-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ghostscript",
               vendor: "Artifex Software",
               versions: [
                  {
                     status: "affected",
                     version: "ghostscript versions prior to 9.28",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-648",
                     description: "CWE-648",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-04-01T21:06:10",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
            },
            {
               name: "DSA-4518",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2019/dsa-4518",
            },
            {
               name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
            },
            {
               name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/15",
            },
            {
               name: "RHSA-2019:2594",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2594",
            },
            {
               name: "FEDORA-2019-0a9d525d71",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
            },
            {
               name: "FEDORA-2019-953fc0f16d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
            },
            {
               name: "FEDORA-2019-ebd6c4f15a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
            },
            {
               name: "openSUSE-SU-2019:2222",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
            },
            {
               name: "openSUSE-SU-2019:2223",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
            },
            {
               name: "RHBA-2019:2824",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHBA-2019:2824",
            },
            {
               name: "GLSA-202004-03",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202004-03",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14811",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ghostscript",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "ghostscript versions prior to 9.28",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Artifex Software",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-648",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
                  },
                  {
                     name: "DSA-4518",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2019/dsa-4518",
                  },
                  {
                     name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
                  },
                  {
                     name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/15",
                  },
                  {
                     name: "RHSA-2019:2594",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2594",
                  },
                  {
                     name: "FEDORA-2019-0a9d525d71",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
                  },
                  {
                     name: "FEDORA-2019-953fc0f16d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
                  },
                  {
                     name: "FEDORA-2019-ebd6c4f15a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
                  },
                  {
                     name: "openSUSE-SU-2019:2222",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
                  },
                  {
                     name: "openSUSE-SU-2019:2223",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
                  },
                  {
                     name: "RHBA-2019:2824",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHBA-2019:2824",
                  },
                  {
                     name: "GLSA-202004-03",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202004-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14811",
      datePublished: "2019-09-03T15:17:12",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:38.930Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14813
Vulnerability from cvelistv5
Published
2019-09-06 13:27
Modified
2024-08-05 00:26
Severity ?
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813x_refsource_CONFIRM
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33x_refsource_CONFIRM
https://www.debian.org/security/2019/dsa-4518vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2019/09/msg00007.htmlmailing-list, x_refsource_MLIST
https://seclists.org/bugtraq/2019/Sep/15mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2019:2594vendor-advisory, x_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHBA-2019:2824vendor-advisory, x_refsource_REDHAT
https://security.gentoo.org/glsa/202004-03vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Artifex Software ghostscript Version: ghostscript versions 9.x before 9.28
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.065Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33",
               },
               {
                  name: "DSA-4518",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2019/dsa-4518",
               },
               {
                  name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
               },
               {
                  name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/15",
               },
               {
                  name: "RHSA-2019:2594",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2594",
               },
               {
                  name: "FEDORA-2019-0a9d525d71",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
               },
               {
                  name: "FEDORA-2019-953fc0f16d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
               },
               {
                  name: "FEDORA-2019-ebd6c4f15a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
               },
               {
                  name: "openSUSE-SU-2019:2222",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
               },
               {
                  name: "openSUSE-SU-2019:2223",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
               },
               {
                  name: "RHBA-2019:2824",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHBA-2019:2824",
               },
               {
                  name: "GLSA-202004-03",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202004-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ghostscript",
               vendor: "Artifex Software",
               versions: [
                  {
                     status: "affected",
                     version: "ghostscript versions 9.x before 9.28",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-648",
                     description: "CWE-648",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-04-01T21:06:08",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33",
            },
            {
               name: "DSA-4518",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2019/dsa-4518",
            },
            {
               name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
            },
            {
               name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/15",
            },
            {
               name: "RHSA-2019:2594",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2594",
            },
            {
               name: "FEDORA-2019-0a9d525d71",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
            },
            {
               name: "FEDORA-2019-953fc0f16d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
            },
            {
               name: "FEDORA-2019-ebd6c4f15a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
            },
            {
               name: "openSUSE-SU-2019:2222",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
            },
            {
               name: "openSUSE-SU-2019:2223",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
            },
            {
               name: "RHBA-2019:2824",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHBA-2019:2824",
            },
            {
               name: "GLSA-202004-03",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202004-03",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14813",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ghostscript",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "ghostscript versions 9.x before 9.28",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Artifex Software",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-648",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813",
                  },
                  {
                     name: "http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33",
                     refsource: "CONFIRM",
                     url: "http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33",
                  },
                  {
                     name: "DSA-4518",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2019/dsa-4518",
                  },
                  {
                     name: "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
                  },
                  {
                     name: "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/15",
                  },
                  {
                     name: "RHSA-2019:2594",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2594",
                  },
                  {
                     name: "FEDORA-2019-0a9d525d71",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
                  },
                  {
                     name: "FEDORA-2019-953fc0f16d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
                  },
                  {
                     name: "FEDORA-2019-ebd6c4f15a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
                  },
                  {
                     name: "openSUSE-SU-2019:2222",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
                  },
                  {
                     name: "openSUSE-SU-2019:2223",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
                  },
                  {
                     name: "RHBA-2019:2824",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHBA-2019:2824",
                  },
                  {
                     name: "GLSA-202004-03",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202004-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14813",
      datePublished: "2019-09-06T13:27:47",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.065Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

jvndb-2019-012236
Vulnerability from jvndb
Published
2020-02-05 13:51
Modified
2020-02-13 16:36
Severity ?
7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Ghostscript access restriction bypass vulnerability
Details
Ghostscript provided by Artifex Software Inc. contains an access restriction bypass vulnerability (CWE-284). Hiroki MATSUKUMA of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN https://jvn.jp/en/jp/JVN52486659/index.html
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14869
NVD https://nvd.nist.gov/vuln/detail/CVE-2019-14869
Related document http://www.openwall.com/lists/oss-security/2019/11/15/1
Permissions(CWE-264) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
Artifex SoftwareGhostscript
Show details on JVN DB website

To clipboard 

{
   "@rdf:about": "https://jvndb.jvn.jp/en/contents/2019/JVNDB-2019-012236.html",
   "dc:date": "2020-02-13T16:36+09:00",
   "dcterms:issued": "2020-02-05T13:51+09:00",
   "dcterms:modified": "2020-02-13T16:36+09:00",
   description: "Ghostscript provided by Artifex Software Inc. contains an access restriction bypass vulnerability (CWE-284).\r\n\r\nHiroki MATSUKUMA of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
   link: "https://jvndb.jvn.jp/en/contents/2019/JVNDB-2019-012236.html",
   "sec:cpe": {
      "#text": "cpe:/a:artifex:ghostscript",
      "@product": "Ghostscript",
      "@vendor": "Artifex Software",
      "@version": "2.2",
   },
   "sec:cvss": [
      {
         "@score": "6.8",
         "@severity": "Medium",
         "@type": "Base",
         "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
         "@version": "2.0",
      },
      {
         "@score": "7.8",
         "@severity": "High",
         "@type": "Base",
         "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
         "@version": "3.0",
      },
   ],
   "sec:identifier": "JVNDB-2019-012236",
   "sec:references": [
      {
         "#text": "https://jvn.jp/en/jp/JVN52486659/index.html",
         "@id": "JVN#52486659",
         "@source": "JVN",
      },
      {
         "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14869",
         "@id": "CVE-2019-14869",
         "@source": "CVE",
      },
      {
         "#text": "https://nvd.nist.gov/vuln/detail/CVE-2019-14869",
         "@id": "CVE-2019-14869",
         "@source": "NVD",
      },
      {
         "#text": "http://www.openwall.com/lists/oss-security/2019/11/15/1",
         "@id": "CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys",
         "@source": "Related document",
      },
      {
         "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
         "@id": "CWE-264",
         "@title": "Permissions(CWE-264)",
      },
   ],
   title: "Ghostscript access restriction bypass vulnerability",
}