CVE-2019-3838

It was found that the forceput operator could be extracted from the DefineResource method. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Mitigation Please refer to the "Mitigation"...

CVE-2019-14813

A flaw was found in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands...

openSUSE Security Update : ghostscript (openSUSE-2019-2223)

This update for ghostscript fixes the following issues : Security issues fixed : - CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. bsc1129180 - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators...

openSUSE Security Update : ghostscript (openSUSE-2019-2222)

This update for ghostscript fixes the following issues : Security issues fixed : - CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. bsc1129180 - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators...

openSUSE: Security Advisory for ghostscript (openSUSE-SU-2019:2222-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:2222-1 Security update for ghostscript

This update for ghostscript fixes the following issues: Security issues fixed: - CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. bsc1129180 - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators...

Security update for ghostscript (important)

openSUSE Security Update: Security update for ghostscript Announcement ID: openSUSE-SU-2019:2222-1 Rating: important References: 1129180 1129186 1134156 1140359 1146882 1146884 Cross-References: CVE-2019-12973 CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 CVE-2019-3835 CVE-2019-3839...

Security update for ghostscript (important)

openSUSE Security Update: Security update for ghostscript Announcement ID: openSUSE-SU-2019:2223-1 Rating: important References: 1129180 1129186 1134156 1140359 1146882 1146884 Cross-References: CVE-2019-12973 CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 CVE-2019-3835 CVE-2019-3839...

SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2019:2478-1)

This update for ghostscript to 9.27 fixes the following issues : Security issues fixed : CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. bsc1129180 CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators...

SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2019:2460-1)

This update for ghostscript fixes the following issues : Security issues fixed : CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. bsc1129180 CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators. bsc11341...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10426

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10425

Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10424

Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10413

Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

The vulnerability of the .pdfhook_DSC_Creator procedure of the Ghostscript file conversion program allows a hacker to gain access to the file system.

The vulnerability of the .pdfhookDSCCreator procedure of the Ghostscript file conversion program is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to the file system by circumventing the restrictions imposed by -dSAFER, using a...

The vulnerability of the .buildfont1 procedure in the Ghostscript file conversion program allows a perpetrator to gain elevated privileges and access to the file system.

The vulnerability of the .buildfont1 procedure in the Ghostscript file conversion program is related to the improper use of privileged APIs. Exploiting this vulnerability allows a malicious actor to enhance their privileges and gain access to the file system beyond the restrictions imposed by...

The vulnerability of the .setuserparams2 procedure of the Ghostscript file conversion program allows a attacker to execute arbitrary commands or gain access to the file system.

The vulnerability of the .setuserparams2 procedure in the Ghostscript file conversion program is related to the improper use of privileged APIs. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands or gain access to the file system by circumventing t...