CVE-2019-14811

moderate-risk

Published 2019-09-03

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

Do I need to act?

1.7% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (11)

Ghostscript

Openshift Container Platform

Fedora

Leap

Debian Linux

Affected Vendors

Debian Redhat Fedoraproject Opensuse Artifex

References (24)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html

Third Party Advisory https://access.redhat.com/errata/RHBA-2019:2824

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2594

Exploit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811

Mailing List https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2019/Sep/15

Third Party Advisory https://security.gentoo.org/glsa/202004-03

Third Party Advisory https://www.debian.org/security/2019/dsa-4518

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html

Third Party Advisory https://access.redhat.com/errata/RHBA-2019:2824

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2594

Exploit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811

Mailing List https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

and 4 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 5/34 · Minimal

Exposure 16/34 · Moderate