Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:2535-1

Опубликовано: 20 нояб. 2019
Источник: suse-cvrf

Описание

Security update for ghostscript

This update for ghostscript fixes the following issues:

  • CVE-2019-14869: Fixed a possible dSAFER escape which could have allowed an attacker to gain high privileges by a specially crafted Postscript code (bsc#1156275).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.1
ghostscript-9.27-lp151.3.9.1
ghostscript-devel-9.27-lp151.3.9.1
ghostscript-mini-9.27-lp151.3.9.1
ghostscript-mini-devel-9.27-lp151.3.9.1
ghostscript-x11-9.27-lp151.3.9.1

Ссылки

Описание

A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.

Затронутые продукты
openSUSE Leap 15.1:ghostscript-9.27-lp151.3.9.1
openSUSE Leap 15.1:ghostscript-devel-9.27-lp151.3.9.1
openSUSE Leap 15.1:ghostscript-mini-9.27-lp151.3.9.1
openSUSE Leap 15.1:ghostscript-mini-devel-9.27-lp151.3.9.1
Ссылки