New ghostscript packages are available for Slackware 14.2 and
-current to fix security issues.

- Security fix for CVE-2019-3835 CVE-2019-3838

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ghostscript: superexec operator is available (700585)     (CVE-2019-3835)

  - ghostscript: forceput in DefineResource is still     accessible (700576) (CVE-2019-3838)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the forceput operator could be     extracted from the DefineResource method. A specially     crafted PostScript file could use this flaw in order     to, for example, have access to the file system outside     of the constrains imposed by -dSAFER.(CVE-2019-3838)

  - t was found that the superexec operator was available     in the internal dictionary. A specially crafted     PostScript file could use this flaw in order to, for     example, have access to the file system outside of the     constrains imposed by -dSAFER.(CVE-2019-3835)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter     by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute     arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3781)

  - The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before     1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the     heap via malformed image files, as originally demonstrated using imagemagick convert. (CVE-2007-2721)

  - Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows     remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a     .seticcspace operator. (CVE-2008-0411)

  - Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2     decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to     execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length     value. (CVE-2009-0196)

  - Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka     icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and     earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and     application crash) or possibly execute arbitrary code by using a device file for a translation request     that operates on a crafted image file and targets a certain native color space, related to an ICC     profile in a (1) PostScript or (2) PDF file with embedded images. (CVE-2009-0583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0123 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10216:
    In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a     specially crafted PostScript file that could escalate privileges and access files outside of restricted     areas.

    CVE-2019-14811:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14812:
    A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14813:
    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did     not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security protection and then have access to the file system, or     execute arbitrary commands.

    CVE-2019-14817:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where     it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14869:
    A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate     privileges within the Ghostscript and access files outside of restricted areas or execute commands.

    CVE-2019-3835:
    It was found that the superexec operator was available in the internal dictionary in ghostscript before     9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the     file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3838:
    It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3839:
    It was found that in ghostscript some privileged operators remained accessible from various places after     the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before     9.27 are vulnerable.

    CVE-2019-6116:
    In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system     operators, leading to remote code execution.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ghostscript fixes the following issues :

Security issues fixed :

  - CVE-2019-3835: Fixed an unauthorized file system access     caused by an available superexec operator. (bsc#1129180)

  - CVE-2019-3839: Fixed an unauthorized file system access     caused by available privileged operators. (bsc#1134156)

  - CVE-2019-12973: Fixed a denial-of-service vulnerability     in the OpenJPEG function opj_t1_encode_cblks.
    (bsc#1140359)

  - CVE-2019-14811: Fixed a safer mode bypass by .forceput     exposure in .pdf_hook_DSC_Creator. (bsc#1146882)

  - CVE-2019-14812: Fixed a safer mode bypass by .forceput     exposure in setuserparams. (bsc#1146882)

  - CVE-2019-14813: Fixed a safer mode bypass by .forceput     exposure in setsystemparams. (bsc#1146882)

  - CVE-2019-14817: Fixed a safer mode bypass by .forceput     exposure in .pdfexectoken and other procedures.
    (bsc#1146884)

This update was imported from the SUSE:SLE-15:Update update project.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
123649	Slackware 14.2 / current : ghostscript (SSA:2019-092-01)	Nessus	Slackware Local Security Checks	2019/4/3	2024/6/6	high
123763	Fedora 28 : ghostscript (2019-9f28451404)	Nessus	Fedora Local Security Checks	2019/4/5	2024/6/5	medium
124384	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2019-1288)	Nessus	Huawei Local Security Checks	2019/4/30	2024/5/30	medium
124968	EulerOS Virtualization 3.0.1.0 : ghostscript (EulerOS-SA-2019-1465)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	medium
330512	NewStart CGSL MAIN 6.06 : ghostscript Multiple Vulnerabilities (NS-SA-2026-0055)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/30	critical
236536	Alibaba Cloud Linux 3 : 0123: ghostscript (ALINUX3-SA-2022:0123)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
129482	openSUSE Security Update : ghostscript (openSUSE-2019-2222)	Nessus	SuSE Local Security Checks	2019/10/1	2024/4/22	critical

検出

プラグインの検索

high

medium

medium

medium

critical

critical

critical