CVE-2019-3838

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
redhatCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
VendorProductVersion
artifexghostscript
𝑥
< 9.27
redhatansible_tower
3.3
redhatenterprise_linux
5.0
redhatenterprise_linux
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_workstation
7.0
opensuseleap
15.0
opensuseleap
42.3
debiandebian_linux
8.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ghostscript
bullseye
9.53.3~dfsg-7+deb11u7
fixed
bullseye (security)
9.53.3~dfsg-7+deb11u8
fixed
bookworm
10.0.0~dfsg-11+deb12u4
fixed
bookworm (security)
10.0.0~dfsg-11+deb12u5
fixed
sid
10.04.0~dfsg-1
fixed
trixie
10.04.0~dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ghostscript
cosmic
Fixed 9.26~dfsg+0-0ubuntu0.18.10.8
released
bionic
Fixed 9.26~dfsg+0-0ubuntu0.18.04.8
released
xenial
Fixed 9.26~dfsg+0-0ubuntu0.16.04.8
released
trusty
Fixed 9.26~dfsg+0-0ubuntu0.14.04.8
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00018.html
http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html
https://access.redhat.com/errata/RHSA-2019:0652
https://access.redhat.com/errata/RHSA-2019:0971
https://bugs.ghostscript.com/show_bug.cgi?id=700576
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3838
https://lists.debian.org/debian-lts-announce/2019/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQAEHQCKSEMIBINHUNIGHTDCZD7F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANBSCZABXQUEQWIKNWJ35IYX24M227EI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVERLGEU3OV6RNZ2SIBXREWD3BF5H23N/
https://seclists.org/bugtraq/2019/Apr/28
https://seclists.org/bugtraq/2019/Apr/4
https://security.gentoo.org/glsa/202004-03
https://www.debian.org/security/2019/dsa-4432
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00018.html
http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html
https://access.redhat.com/errata/RHSA-2019:0652
https://access.redhat.com/errata/RHSA-2019:0971
https://bugs.ghostscript.com/show_bug.cgi?id=700576
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3838
https://lists.debian.org/debian-lts-announce/2019/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQAEHQCKSEMIBINHUNIGHTDCZD7F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANBSCZABXQUEQWIKNWJ35IYX24M227EI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVERLGEU3OV6RNZ2SIBXREWD3BF5H23N/
https://seclists.org/bugtraq/2019/Apr/28
https://seclists.org/bugtraq/2019/Apr/4
https://security.gentoo.org/glsa/202004-03
https://www.debian.org/security/2019/dsa-4432