EUVD-2019-5942

Malware in sbrugna...

The vulnerability of the .tempfile component in the software suite for processing, transforming, and generating Ghostscript documents allows a perpetrator to circumvent the dSAFER protection mechanism, delete files, or gain unauthorized access to protected information.

The vulnerability of the .tempfile component in the software for processing, transforming, and generating Ghostscript documents is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to bypass the dSAFER protection, delete files, or gain unauthorized...

CVE-2019-14812

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass "-dSAFER" restrictions. A specially crafted PostScript file could disable security protection and then have access to th...

CVE-2019-14869: Incorrect Use of Privileged APIs

A flaw was found in all versions of ghostscript 9.x before 9.50, where the .charkeys procedure, where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could...

CVE-2019-14817

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass "-dSAFER" restrictions. A specially crafted PostScript file could disable security protection and then have access t...

CVE-2019-14811

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass "-dSAFER" restrictions. A specially crafted PostScript file could disable security protection and then have access to the...

PT-2019-3237

Name of the Vulnerable Software and Affected Versions ghostscript versions 9.x before 9.50 Description A flaw in the setsystemparams procedure of ghostscript enables scripts to bypass -dSAFER restrictions. This allows a specially crafted PostScript file to disable security protection, potentially...

NewStart CGSL MAIN 4.05 : ghostscript Vulnerability (NS-SA-2019-0145)

The remote NewStart CGSL host, running version MAIN 4.05, has ghostscript packages installed that are affected by a vulnerability: - It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection...

CVE-2018-16863: Incomplete List of Disallowed Inputs

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as...

PT-2018-3467

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 9.23 Description: The issue is related to insufficient access control in the .tempfile component of the Ghostscript software suite for document processing, conversion, and generation. Exploitation of this...