rpm package
suse/ghostscript&distro=SUSE Linux Enterprise Server 12 SP2-BCL
pkg:rpm/suse/ghostscript&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL
Vulnerabilities (38)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-36664 | — | < 9.52-23.54.1 | 9.52-23.54.1 | Jun 25, 2023 | Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). | ||
| CVE-2023-28879 | — | < 9.52-23.51.1 | 9.52-23.51.1 | Mar 31, 2023 | In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than fu | ||
| CVE-2021-3781 | — | < 9.52-23.42.1 | 9.52-23.42.1 | Feb 16, 2022 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript in | ||
| CVE-2020-15900 | — | < 9.52-23.39.1 | 9.52-23.39.1 | Jul 28, 2020 | A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32 | ||
| CVE-2020-12268 | — | < 9.52-23.34.1 | 9.52-23.34.1 | Apr 27, 2020 | jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow. | ||
| CVE-2019-14812 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Nov 27, 2019 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then | ||
| CVE-2019-14869 | — | < 9.27-23.31.1 | 9.27-23.31.1 | Nov 15, 2019 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript | ||
| CVE-2019-14813 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Sep 6, 2019 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then hav | ||
| CVE-2019-14817 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Sep 3, 2019 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and t | ||
| CVE-2019-14811 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Sep 3, 2019 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then | ||
| CVE-2019-12973 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Jun 26, 2019 | In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. | ||
| CVE-2019-3839 | — | < 9.27-23.28.1 | 9.27-23.28.1 | May 16, 2019 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -d | ||
| CVE-2019-3835 | — | < 9.27-23.28.1 | 9.27-23.28.1 | Mar 25, 2019 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. | ||
| CVE-2019-3838 | — | < 9.26a-23.22.1 | 9.26a-23.22.1 | Mar 25, 2019 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. | ||
| CVE-2019-6116 | — | < 9.26a-23.19.1 | 9.26a-23.19.1 | Mar 19, 2019 | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. | ||
| CVE-2018-19477 | — | < 9.26-23.16.1 | 9.26-23.16.1 | Nov 23, 2018 | psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion. | ||
| CVE-2018-19476 | — | < 9.26-23.16.1 | 9.26-23.16.1 | Nov 23, 2018 | psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion. | ||
| CVE-2018-19475 | — | < 9.26-23.16.1 | 9.26-23.16.1 | Nov 23, 2018 | psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. | ||
| CVE-2018-19409 | — | < 9.26-23.16.1 | 9.26-23.16.1 | Nov 21, 2018 | An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. | ||
| CVE-2018-18284 | — | < 9.26-23.16.1 | 9.26-23.16.1 | Oct 19, 2018 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. |
- CVE-2023-36664Jun 25, 2023affected < 9.52-23.54.1fixed 9.52-23.54.1
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
- CVE-2023-28879Mar 31, 2023affected < 9.52-23.51.1fixed 9.52-23.51.1
In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than fu
- CVE-2021-3781Feb 16, 2022affected < 9.52-23.42.1fixed 9.52-23.42.1
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript in
- CVE-2020-15900Jul 28, 2020affected < 9.52-23.39.1fixed 9.52-23.39.1
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32
- CVE-2020-12268Apr 27, 2020affected < 9.52-23.34.1fixed 9.52-23.34.1
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
- CVE-2019-14812Nov 27, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then
- CVE-2019-14869Nov 15, 2019affected < 9.27-23.31.1fixed 9.27-23.31.1
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript
- CVE-2019-14813Sep 6, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then hav
- CVE-2019-14817Sep 3, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and t
- CVE-2019-14811Sep 3, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then
- CVE-2019-12973Jun 26, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
- CVE-2019-3839May 16, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -d
- CVE-2019-3835Mar 25, 2019affected < 9.27-23.28.1fixed 9.27-23.28.1
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
- CVE-2019-3838Mar 25, 2019affected < 9.26a-23.22.1fixed 9.26a-23.22.1
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
- CVE-2019-6116Mar 19, 2019affected < 9.26a-23.19.1fixed 9.26a-23.19.1
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
- CVE-2018-19477Nov 23, 2018affected < 9.26-23.16.1fixed 9.26-23.16.1
psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.
- CVE-2018-19476Nov 23, 2018affected < 9.26-23.16.1fixed 9.26-23.16.1
psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.
- CVE-2018-19475Nov 23, 2018affected < 9.26-23.16.1fixed 9.26-23.16.1
psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
- CVE-2018-19409Nov 21, 2018affected < 9.26-23.16.1fixed 9.26-23.16.1
An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
- CVE-2018-18284Oct 19, 2018affected < 9.26-23.16.1fixed 9.26-23.16.1
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
Page 1 of 2