Red Hat Security AdvisoryRHSA-2019:3888
ghostscript security update
Released 2019-11-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ghostscript-9.25-2.el7_7.3, ghostscript-cups-9.25-2.el7_7.3, libgs-9.25-2.el7_7.3
- Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-doc-9.25-2.el7_7.3, ghostscript-gtk-9.25-2.el7_7.3, libgs-devel-9.25-2.el7_7.3
- Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript-9.25-2.el7_7.3, ghostscript-cups-9.25-2.el7_7.3, libgs-9.25-2.el7_7.3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-doc-9.25-2.el7_7.3, ghostscript-gtk-9.25-2.el7_7.3, libgs-devel-9.25-2.el7_7.3
- Red Hat Enterprise Linux Server (v. 7) ghostscript-9.25-2.el7_7.3, ghostscript-9.25-2.el7_7.3.ppc, ghostscript-cups-9.25-2.el7_7.3 +2
- Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-doc-9.25-2.el7_7.3, ghostscript-gtk-9.25-2.el7_7.3, libgs-devel-9.25-2.el7_7.3 +1
- Red Hat Enterprise Linux Workstation (v. 7) ghostscript-9.25-2.el7_7.3, ghostscript-cups-9.25-2.el7_7.3, libgs-9.25-2.el7_7.3
- Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-doc-9.25-2.el7_7.3, ghostscript-gtk-9.25-2.el7_7.3, libgs-devel-9.25-2.el7_7.3
Fixes 1 record
Priority MEDIUM 44
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03094 · Published 2019-11-15 · Fixed CWE-648
