Red Hat Security AdvisoryRHSA-2019:0971
ghostscript security update
Released 2019-05-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) ghostscript-doc-9.25-2.el8_0.1, ghostscript-tools-dvipdf-9.25-2.el8_0.1, ghostscript-tools-fonts-9.25-2.el8_0.1 +3
- Red Hat Enterprise Linux AppStream (v. 8) ghostscript-9.25-2.el8_0.1, libgs-9.25-2.el8_0.1
Fixes 3 records
Priority LOW 37
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01706 · Published 2019-05-16 · Partial fix CWE-648
Priority LOW 30
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02473 · Published 2019-03-25 · Partial fix CWE-648
Priority LOW 30
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02473 · Published 2019-03-25 · Partial fix CWE-648
