Package ghostscript updated to version 9.28-alt0.rc1.2 for branch sisyphus in task 259037.

Published: 2019-11-14

BDU:2020-01769

Уязвимость процедуры .charkeys интерпретатора PostScript/PDF Ghostscript, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2019-14869

Published: 2019-11-15
Modified: 2024-11-21

CVE-2019-14869

A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Version: 2.1.0

Package ghostscript update in sisyphus on 2020-10-01

ALT-PU-2020-2906-1

Closed vulnerabilities

BDU:2020-01769

CVE-2019-14869