rpm package
opensuse/ghostscript-mini&distro=openSUSE Leap 15.0
pkg:rpm/opensuse/ghostscript-mini&distro=openSUSE%20Leap%2015.0
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-14812 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Nov 27, 2019 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then | ||
| CVE-2019-10216 | — | < 9.26a-lp150.2.20.1 | 9.26a-lp150.2.20.1 | Nov 27, 2019 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and acce | ||
| CVE-2019-14869 | — | < 9.27-lp150.2.26.1 | 9.27-lp150.2.26.1 | Nov 15, 2019 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript | ||
| CVE-2019-14813 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Sep 6, 2019 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then hav | ||
| CVE-2019-14817 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Sep 3, 2019 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and t | ||
| CVE-2019-14811 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Sep 3, 2019 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then | ||
| CVE-2019-12973 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Jun 26, 2019 | In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. | ||
| CVE-2019-3839 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | May 16, 2019 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -d | ||
| CVE-2019-3835 | — | < 9.27-lp150.2.23.1 | 9.27-lp150.2.23.1 | Mar 25, 2019 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. | ||
| CVE-2019-3838 | — | < 9.26a-lp150.2.17.2 | 9.26a-lp150.2.17.2 | Mar 25, 2019 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. | ||
| CVE-2019-6116 | — | < 9.26a-lp150.2.12.1 | 9.26a-lp150.2.12.1 | Mar 19, 2019 | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. |
- CVE-2019-14812Nov 27, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then
- CVE-2019-10216Nov 27, 2019affected < 9.26a-lp150.2.20.1fixed 9.26a-lp150.2.20.1
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and acce
- CVE-2019-14869Nov 15, 2019affected < 9.27-lp150.2.26.1fixed 9.27-lp150.2.26.1
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript
- CVE-2019-14813Sep 6, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then hav
- CVE-2019-14817Sep 3, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and t
- CVE-2019-14811Sep 3, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then
- CVE-2019-12973Jun 26, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
- CVE-2019-3839May 16, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -d
- CVE-2019-3835Mar 25, 2019affected < 9.27-lp150.2.23.1fixed 9.27-lp150.2.23.1
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
- CVE-2019-3838Mar 25, 2019affected < 9.26a-lp150.2.17.2fixed 9.26a-lp150.2.17.2
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
- CVE-2019-6116Mar 19, 2019affected < 9.26a-lp150.2.12.1fixed 9.26a-lp150.2.12.1
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.