Red Hat Security Advisory

RHSA-2019:2586

ghostscript security update

Released 2019-09-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) ghostscript-9.25-2.el7_7.2, ghostscript-cups-9.25-2.el7_7.2, libgs-9.25-2.el7_7.2
Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-doc-9.25-2.el7_7.2, ghostscript-gtk-9.25-2.el7_7.2, libgs-devel-9.25-2.el7_7.2
Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript-9.25-2.el7_7.2, ghostscript-cups-9.25-2.el7_7.2, libgs-9.25-2.el7_7.2
Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-doc-9.25-2.el7_7.2, ghostscript-gtk-9.25-2.el7_7.2, libgs-devel-9.25-2.el7_7.2
Red Hat Enterprise Linux Server (v. 7) ghostscript-9.25-2.el7_7.2, ghostscript-9.25-2.el7_7.2.ppc, ghostscript-cups-9.25-2.el7_7.2 +2
Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-doc-9.25-2.el7_7.2, ghostscript-gtk-9.25-2.el7_7.2, libgs-devel-9.25-2.el7_7.2 +1
Red Hat Enterprise Linux Workstation (v. 7) ghostscript-9.25-2.el7_7.2, ghostscript-cups-9.25-2.el7_7.2, libgs-9.25-2.el7_7.2
Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-doc-9.25-2.el7_7.2, ghostscript-gtk-9.25-2.el7_7.2, libgs-devel-9.25-2.el7_7.2

Fixes 4 records

TI-2019-11018 CVE-2019-14813 · GHSA-r3w6-mj6m-w4m6

Incorrect authorization in Artifex ghostscript

MEDIUM 55

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10963 Published 2019-09-06 Partial fix CWE-648

TI-2019-11016 CVE-2019-14811 · GHSA-q58c-x76h-3jhc

Incorrect authorization in Artifex ghostscript

MEDIUM 40

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.03746 Published 2019-09-03 Partial fix CWE-648

TI-2019-11017 CVE-2019-14812 · GHSA-rmmv-j9x6-f2v4

Incorrect permission assignment in Red Hat ghostscript

LOW 39

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02473 Published 2019-11-27 Partial fix · 9.50 CWE-648

TI-2019-11022 CVE-2019-14817 · GHSA-f4cx-p6hx-chwv

Incorrect authorization in Artifex ghostscript

LOW 38

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02025 Published 2019-09-03 Partial fix CWE-648