A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1598 advisory.

    Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by     remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to     inject code. (CVE-2018-17183)

    Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors     involving errorhandler setup. NOTE: this issue exists because of an incomplete fix forCVE-2018-17183.
    (CVE-2018-17961)

    Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of     system operators in the saved execution stack in an error object. (CVE-2018-18073)

    Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors     involving the 1Policy operator. (CVE-2018-18284)

    In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A     specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute     arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of     failure to check whether the Implementation of a pattern dictionary was a structure type. (CVE-2018-19134)

    An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if     another device is used. (CVE-2018-19409)

    psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because available stack space is not checked when the device remains the same.
    (CVE-2018-19475)

    psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because of a setcolorspace type confusion. (CVE-2018-19476)

    psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because of a JBIG2Decode type confusion. (CVE-2018-19477)

    A flaw was found in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could     disable security protection and then have access to the file system, or execute arbitrary commands.
    (CVE-2019-14811)

    A flaw was found in the .setuserparams2 procedure where it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable     security protection and then have access to the file system, or execute arbitrary commands.
    (CVE-2019-14812)

    A flaw was found in the setsystemparams procedure where it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable     security protection and then have access to the file system, or execute arbitrary commands.
    (CVE-2019-14813)

    A flaw was found in the .pdfexectoken and other procedures where it did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could     disable security protection and then have access to the file system, or execute arbitrary commands.
    (CVE-2019-14817)

    A flaw was found in the `.charkeys` procedure, where it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a     specially crafted PostScript file that could escalate privileges within the Ghostscript and access files     outside of restricted areas or execute commands. (CVE-2019-14869)

    It was found that the superexec operator was available in the internal dictionary.  A specially crafted     PostScript file could use this flaw in order to, for example, have access to the file system outside of     the constrains imposed by -dSAFER. (CVE-2019-3835)

    It was found that the forceput operator could be extracted from the DefineResource method. A specially     crafted PostScript file could use this flaw in order to, for example, have access to the file system     outside of the constrains imposed by -dSAFER. (CVE-2019-3838)

    It was found that some privileged operators remained accessible from various places after     theCVE-2019-6116fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3839)

    It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator     pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER     protection in order to, for example, have access to the file system outside of the SAFER constraints.
    (CVE-2019-6116)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3890 advisory.

  - ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0222 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ghostscript packages installed that are affected by a vulnerability:

  - A flaw was found in all versions of ghostscript 9.x     before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. An attacker     could abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges within     the Ghostscript and access files outside of restricted     areas or execute commands. (CVE-2019-14869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in all versions of ghostscript 9.x     before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. An attacker     could abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges within     the Ghostscript and access files outside of restricted     areas or execute commands.(CVE-2019-14869)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in all versions of ghostscript 9.x     before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. An attacker     could abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges within     the Ghostscript and access files outside of restricted     areas or execute commands.(CVE-2019-14869)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by a vulnerability:

  - A flaw was found in all versions of ghostscript 9.x     before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. An attacker     could abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges within     the Ghostscript and access files outside of restricted     areas or execute commands. (CVE-2019-14869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3890 advisory.

    [9.25-5.1]
    - 1769342 - CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-14869

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following issues :

  - CVE-2019-14869: Fixed a possible dSAFER escape which     could have allowed an attacker to gain high privileges     by a specially crafted Postscript code (bsc#1156275).
    This update was imported from the SUSE:SLE-15:Update     update project.

This update for ghostscript fixes the following issue :

CVE-2019-14869: Fixed a possible dSAFER escape which could have allowed an attacker to gain high privileges by a specially crafted Postscript code (bsc#1156275).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following issues :

CVE-2019-14869: Fixed a possible dSAFER escape which could have allowed an attacker to gain high privileges by a specially crafted Postscript code (bsc#1156275).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3888 advisory.

    [9.25-2.3]
    - 1769340 - CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4193-1 advisory.

    Paul Manfred and Lukas Schauer discovered that Ghostscript incorrectly handled certain PostScript files.
    If a user or automated system were tricked into processing a specially crafted file, a remote attacker     could possibly use this issue to access arbitrary files, execute arbitrary code, or cause a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - ghostscript: -dSAFER escape in .charkeys (701841)     (CVE-2019-14869)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3890 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3888 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.

Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.

For Debian 8 'Jessie', this problem has been fixed in version 9.26a~dfsg-0+deb8u6.

We recommend that you upgrade your ghostscript packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
146633	Amazon Linux 2 : ghostscript (ALAS-2021-1598)	Nessus	Amazon Linux Local Security Checks	critical
145677	CentOS 8 : ghostscript (CESA-2019:3890)	Nessus	CentOS Local Security Checks	high
144019	Virtuozzo 7 : ghostscript / ghostscript-cups / ghostscript-doc / etc (VZLSA-2019-3888)	Nessus	Virtuozzo Local Security Checks	high
133223	RHEL 8 : ghostscript (RHSA-2020:0222)	Nessus	Red Hat Local Security Checks	high
133083	NewStart CGSL CORE 5.05 / MAIN 5.05 : ghostscript Vulnerability (NS-SA-2020-0007)	Nessus	NewStart CGSL Local Security Checks	high
132813	EulerOS Virtualization for ARM 64 3.0.5.0 : ghostscript (EulerOS-SA-2020-1059)	Nessus	Huawei Local Security Checks	high
132599	EulerOS 2.0 SP8 : ghostscript (EulerOS-SA-2020-1006)	Nessus	Huawei Local Security Checks	high
132481	NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Vulnerability (NS-SA-2019-0265)	Nessus	NewStart CGSL Local Security Checks	high
131569	CentOS 7 : ghostscript (CESA-2019:3888)	Nessus	CentOS Local Security Checks	high
131274	Oracle Linux 8 : ghostscript (ELSA-2019-3890)	Nessus	Oracle Linux Local Security Checks	high
131256	Fedora 29 : ghostscript (2019-7debdd1807)	Nessus	Fedora Local Security Checks	high
131180	openSUSE Security Update : ghostscript (openSUSE-2019-2535)	Nessus	SuSE Local Security Checks	high
131179	openSUSE Security Update : ghostscript (openSUSE-2019-2534)	Nessus	SuSE Local Security Checks	high
131119	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2019:2983-1)	Nessus	SuSE Local Security Checks	high
131118	SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2019:2981-1)	Nessus	SuSE Local Security Checks	high
131113	Oracle Linux 7 : ghostscript (ELSA-2019-3888)	Nessus	Oracle Linux Local Security Checks	high
131094	Fedora 31 : ghostscript (2019-6cdb10aa59)	Nessus	Fedora Local Security Checks	high
131089	Fedora 30 : ghostscript (2019-17f42f585a)	Nessus	Fedora Local Security Checks	high
131073	Ubuntu 16.04 LTS / 18.04 LTS : Ghostscript vulnerability (USN-4193-1)	Nessus	Ubuntu Local Security Checks	high
131054	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20191114)	Nessus	Scientific Linux Local Security Checks	high
131053	RHEL 8 : ghostscript (RHSA-2019:3890)	Nessus	Red Hat Local Security Checks	high
131051	RHEL 7 : ghostscript (RHSA-2019:3888)	Nessus	Red Hat Local Security Checks	high
131036	Debian DSA-4569-1 : ghostscript - security update	Nessus	Debian Local Security Checks	high
131035	Debian DLA-1992-1 : ghostscript security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-14869

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high