VuXML ID | Description |
22ae307a-1ac4-11ea-b267-001cc0382b2f | Ghostscript -- Security bypass vulnerabilities
Cedric Buissart (Red Hat) reports:
A flaw was found in, ghostscript versions prior to 9.50, in the
.pdf_hook_DSC_Creator procedure where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.
A flaw was found in all ghostscript versions 9.x before 9.50, in
the .setuserparams2 procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.
A flaw was found in ghostscript, versions 9.x before 9.50, in the
setsystemparams procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.
A flaw was found in, ghostscript versions prior to 9.50, in the
.pdfexectoken and other procedures where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.
Discovery 2019-08-20 Entry 2019-12-09 ghostscript9-agpl-base
ghostscript9-agpl-x11
< 9.50
CVE-2019-14811
CVE-2019-14812
CVE-2019-14813
CVE-2019-14817
|
30c0f878-b03e-11e8-be8a-0011d823eebd | Ghostscript -- arbitrary code execution
CERT reports:
Ghostscript contains an optional -dSAFER option, which is supposed
to prevent unsafe PostScript operations. Multiple PostScript
operations bypass the protections provided by -dSAFER, which can
allow an attacker to execute arbitrary commands with arbitrary
arguments. This vulnerability can also be exploited in applications
that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
evince, Okular, Nautilus, and others.
Exploit code for this vulnerability is publicly available.
Discovery 2018-08-21 Entry 2018-09-04 ghostscript9-agpl-base
ghostscript9-agpl-x11
< 9.24
https://www.kb.cert.org/vuls/id/332928
CVE-2018-15908
CVE-2018-15909
CVE-2018-15910
CVE-2018-15911
|
5ed7102e-6454-11e9-9a3a-001cc0382b2f | Ghostscript -- Security bypass vulnerability
Cedric Buissart (Red Hat) reports:
It was found that the superexec operator was available in the
internal dictionary in ghostscript before 9.27. A specially crafted
PostScript file could use this flaw in order to, for example, have
access to the file system outside of the constrains imposed by
-dSAFER.
It was found that the forceput operator could be extracted from
the DefineResource method in ghostscript before 9.27. A specially
crafted PostScript file could use this flaw in order to, for
example, have access to the file system outside of the constrains
imposed by -dSAFER.
Discovery 2019-03-21 Entry 2019-04-21 ghostscript9-agpl-base
ghostscript9-agpl-x11
< 9.27
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838
CVE-2019-3835
CVE-2019-3838
|
62642942-590f-11eb-a0dc-8c164582fbac | Ghostscript -- SAFER Sandbox Breakout
SO-AND-SO reports:
A memory corruption issue was found in Artifex
Ghostscript 9.50 and 9.52. Use of a non-standard
PostScript operator can allow overriding of file access
controls. The 'rsearch' calculation for the 'post' size
resulted in a size that was too large, and could underflow
to max uint32_t. This was fixed in commit
5d499272b95a6b890a1397e11d20937de000d31b.
Discovery 2020-07-28 Entry 2021-01-17 ghostscript9-agpl-base
ge 9.50 lt 9.52_8
https://nvd.nist.gov/vuln/detail/CVE-2020-15900
|
fc1f6658-4f53-11e5-934b-002590263bf5 | ghostscript -- denial of service (crash) via crafted Postscript files
MITRE reports:
Integer overflow in the gs_heap_alloc_bytes function in
base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted
Postscript (ps) file, as demonstrated by using the ps2pdf command,
which triggers an out-of-bounds read or write.
Discovery 2015-06-17 Entry 2015-09-01 Modified 2015-09-02 ghostscript7
ghostscript7-nox11
ghostscript7-base
ghostscript7-x11
< 7.07_32
ghostscript8
ghostscript8-nox11
ghostscript8-base
ghostscript8-x11
< 8.71_19
ghostscript9
ghostscript9-nox11
ghostscript9-base
ghostscript9-x11
< 9.06_11
ghostscript9-agpl
ghostscript9-agpl-nox11
< 9.15_2
ghostscript9-agpl-base
ghostscript9-agpl-x11
< 9.16_2
CVE-2015-3228
http://bugs.ghostscript.com/show_bug.cgi?id=696041
http://bugs.ghostscript.com/show_bug.cgi?id=696070
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859
|