Ubuntu update for Ghostscript

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU20059

Risk: Low

CVSSv3.1: 2.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10216

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to access arbitrary files on the system.

The vulnerability exists due to an error within the .buildfont1 procedure when making privileged secure calls. A remote attacker can create a specially crafted PostScript file, trick the victim into opening it, bypass the ‘-dSAFER’ restrictions and access arbitrary file on the system.

Mitigation

Update the affected packages.

Ubuntu 19.04

ghostscript - 9.26~dfsg+0-0ubuntu7.2

libgs9 - 9.26~dfsg+0-0ubuntu7.2

Ubuntu 18.04 LTS

ghostscript - 9.26~dfsg+0-0ubuntu0.18.04.10

libgs9 - 9.26~dfsg+0-0ubuntu0.18.04.10

Ubuntu 16.04 LTS

ghostscript - 9.26~dfsg+0-0ubuntu0.16.04.10

libgs9 - 9.26~dfsg+0-0ubuntu0.16.04.10

Vulnerable software versions

ghostscript (Ubuntu package): 9.20~dfsg-1 - 9.26~dfsg+0-0ubuntu8

External links

http://usn.ubuntu.com/4092-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.