Описание
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 9.26~dfsg+0-0ubuntu0.18.04.11 |
| devel | released | 9.27~dfsg+0-0ubuntu3 |
| disco | released | 9.26~dfsg+0-0ubuntu7.3 |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/bionic | released | 9.26~dfsg+0-0ubuntu0.18.04.11 |
| esm-infra/xenial | released | 9.26~dfsg+0-0ubuntu0.16.04.11 |
| precise/esm | DNE | |
| trusty | ignored | end of standard support |
| trusty/esm | DNE | |
| upstream | needs-triage |
Показывать по
EPSS
6.8 Medium
CVSS2
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
A flaw was found in all ghostscript versions 9.x before 9.50, in the . ...
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Уязвимость процедуры .setuserparams2 программы конвертирования файлов формата PostScript Ghostscript, позволяющая нарушителю выполнить произвольные команды или получить доступ к файловой системе
EPSS
6.8 Medium
CVSS2
7.8 High
CVSS3