In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0123 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10216:
    In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a     specially crafted PostScript file that could escalate privileges and access files outside of restricted     areas.

    CVE-2019-14811:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14812:
    A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14813:
    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did     not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security protection and then have access to the file system, or     execute arbitrary commands.

    CVE-2019-14817:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where     it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14869:
    A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate     privileges within the Ghostscript and access files outside of restricted areas or execute commands.

    CVE-2019-3835:
    It was found that the superexec operator was available in the internal dictionary in ghostscript before     9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the     file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3838:
    It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3839:
    It was found that in ghostscript some privileged operators remained accessible from various places after     the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before     9.27 are vulnerable.

    CVE-2019-6116:
    In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system     operators, leading to remote code execution.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     escalate privileges via a crafted PDF file. This is     fixed in v9.51.(CVE-2020-16302)

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The PS Interpreter in Ghostscript 9.18 and 9.20 allows     remote attackers to execute arbitrary code via crafted     userparams.(CVE-2016-7976)

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977.(CVE-2018-11645)

  - A flaw was found in the .pdfexectoken and other     procedures where it did not properly secure its     privileged calls, enabling scripts to bypass `-dSAFER`     restrictions. A specially crafted PostScript file could     disable security protection and then have access to the     file system, or execute arbitrary     commands.(CVE-2019-14817)

  - A flaw was found in the setsystemparams procedure where     it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14813)

  - A flaw was found in the .setuserparams2 procedure where     it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14812)

  - A flaw was found in the .pdf_hook_DSC_Creator procedure     where it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14811)

  - libjbig2dec.a in Artifex jbig2dec 0.13, as used in     MuPDF and Ghostscript, has a NULL pointer dereference     in the jbig2_huffman_get function in jbig2_huffman.c.
    For example, the jbig2dec utility will crash     (segmentation fault) when parsing an invalid     file.(CVE-2017-9216)

  - Artifex jbig2dec 0.13, as used in Ghostscript, allows     out-of-bounds writes because of an integer overflow in     the jbig2_build_huffman_table function in     jbig2_huffman.c during operations on a crafted JBIG2     file, leading to a denial of service (application     crash) or possibly execution of arbitrary     code.(CVE-2017-7975)

  - Artifex jbig2dec 0.13 has a heap-based buffer over-read     leading to denial of service (application crash) or     disclosure of sensitive information from process     memory, because of an integer overflow in the     jbig2_decode_symbol_dict function in     jbig2_symbol_dict.c in libjbig2dec.a during operation     on a crafted .jb2 file.(CVE-2017-7885)

  - Artifex jbig2dec 0.13 allows out-of-bounds writes and     reads because of an integer overflow in the     jbig2_image_compose function in jbig2_image.c during     operations on a crafted .jb2 file, leading to a denial     of service (application crash) or disclosure of     sensitive information from process     memory.(CVE-2017-7976)

  - ghostscript before version 9.21 is vulnerable to a heap     based buffer overflow that was found in the ghostscript     jbig2_decode_gray_scale_image function which is used to     decode halftone segments in a JBIG2 image. A document     (PostScript or PDF) with an embedded, specially     crafted, jbig2 image could trigger a segmentation fault     in ghostscript.(CVE-2016-9601)

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202004-03 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       file using GPL Ghostscript, possibly resulting in execution of arbitrary       code with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977. (CVE-2018-11645)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted areas.
    (CVE-2019-10216)

  - A flaw was found in ghostscript, versions 9.x before     9.50, in the setsystemparams procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14813)

  - A flaw was found in all ghostscript versions 9.x before     9.50, in the .setuserparams2 procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14812)

  - A flaw was found in, ghostscript versions prior to 9.50,     in the .pdf_hook_DSC_Creator procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14811)

  - A flaw was found in, ghostscript versions prior to 9.50,     in the .pdfexectoken and other procedures where it did     not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security     protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Artifex Ghostscript installed on the remote Windows host is prior to 9.50. It is, therefore, affected by multiple security bypass vulnerabilities. An attacker could exploit one of these vulnerabilities to gain access to the file system and execute arbitrary commands.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977. (CVE-2018-11645)

  - A flaw was found in ghostscript, versions 9.x before     9.28, in the setsystemparams procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14813)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdf_hook_DSC_Creator procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14811)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdfexectoken and other procedures where it did     not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security     protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following issues :

Security issue fixed :

  - CVE-2019-10216: Fix privilege escalation via specially     crafted PostScript file (bsc#1144621).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ghostscript fixes the following issues :

Security issue fixed :

CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - ghostscript: -dSAFER escape via .buildfont1 (701394)     (CVE-2019-10216)

- Fix for CVE-2019-10216 added

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2465 advisory.

    [9.25-2.2]
    - Resolves: #1737336 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2462 advisory.

    [9.25-2.1]
    - Resolves: #1737338 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.

For Debian 8 'Jessie', this problem has been fixed in version 9.26a~dfsg-0+deb8u4.

We recommend that you upgrade your ghostscript packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4092-1 advisory.

    Netanel Fisher discovered that the font handler in Ghostscript did not properly restrict privileged calls     when '-dSAFER' restrictions were in effect. If a user or automated system were tricked into processing a     specially crafted file, a remote attacker could possibly use this issue to access arbitrary files.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2465 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape via .buildfont1 (701394) (CVE-2019-10216)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2462 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape via .buildfont1 (701394) (CVE-2019-10216)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.

ID	Name	Product	Family	Severity
236536	Alibaba Cloud Linux 3 : 0123: ghostscript (ALINUX3-SA-2022:0123)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
140881	EulerOS 2.0 SP3 : ghostscript (EulerOS-SA-2020-2114)	Nessus	Huawei Local Security Checks	high
136252	EulerOS Virtualization for ARM 64 3.0.2.0 : ghostscript (EulerOS-SA-2020-1549)	Nessus	Huawei Local Security Checks	high
135661	EulerOS Virtualization 3.0.2.2 : ghostscript (EulerOS-SA-2020-1499)	Nessus	Huawei Local Security Checks	critical
135114	GLSA-202004-03 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
133901	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2020-1100)	Nessus	Huawei Local Security Checks	high
132453	NewStart CGSL CORE 5.05 / MAIN 5.05 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0250)	Nessus	NewStart CGSL Local Security Checks	critical
131503	EulerOS Virtualization for ARM 64 3.0.3.0 : ghostscript (EulerOS-SA-2019-2338)	Nessus	Huawei Local Security Checks	high
130273	Artifex Ghostscript < 9.50 Multiple Vulnerabilities	Nessus	Windows	critical
129908	NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0203)	Nessus	NewStart CGSL Local Security Checks	critical
129435	EulerOS 2.0 SP8 : ghostscript (EulerOS-SA-2019-2076)	Nessus	Huawei Local Security Checks	high
129336	openSUSE Security Update : ghostscript (openSUSE-2019-2160)	Nessus	SuSE Local Security Checks	high
128869	openSUSE Security Update : ghostscript (openSUSE-2019-2139)	Nessus	SuSE Local Security Checks	high
128678	SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2019:2348-1)	Nessus	SuSE Local Security Checks	high
128677	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2019:2347-1)	Nessus	SuSE Local Security Checks	high
128273	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190812)	Nessus	Scientific Linux Local Security Checks	high
128041	Fedora 30 : ghostscript (2019-93e0145607)	Nessus	Fedora Local Security Checks	high
128039	Fedora 29 : ghostscript (2019-22f1c93255)	Nessus	Fedora Local Security Checks	high
127980	Oracle Linux 8 : ghostscript (ELSA-2019-2465)	Nessus	Oracle Linux Local Security Checks	high
127979	Oracle Linux 7 : ghostscript (ELSA-2019-2462)	Nessus	Oracle Linux Local Security Checks	high
127862	Debian DLA-1880-1 : ghostscript security update	Nessus	Debian Local Security Checks	high
127840	Ubuntu 16.04 LTS / 18.04 LTS : Ghostscript vulnerability (USN-4092-1)	Nessus	Ubuntu Local Security Checks	high
127832	RHEL 8 : ghostscript (RHSA-2019:2465)	Nessus	Red Hat Local Security Checks	high
127831	RHEL 7 : ghostscript (RHSA-2019:2462)	Nessus	Red Hat Local Security Checks	high
127823	Debian DSA-4499-1 : ghostscript - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-10216

high

Tenable Plugins

critical

high

high

critical

critical

high

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high