Code Injection in Ghostscript - CVE-2019-14869

Vulnerability identifier: #VU22784

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14869

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing Truetype fonts. A remote attacker can trick the use user to open a specially crafted document and execute arbitrary commands on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ghostscript
ghostscript (Alpine package)
ghostscript (Ubuntu package)
ghostscript
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora

Install update from vendor's website.

Ghostscript - update to 9.50
ghostscript (Alpine package) - update to 9.26-r5
ghostscript (Ubuntu package) - addressed in versions 9.26~dfsg+0-0ubuntu0.16.04.12, 9.26~dfsg+0-0ubuntu0.18.04.12, 9.26~dfsg+0-0ubuntu7.4, 9.27~dfsg+0-0ubuntu3.1
ghostscript - addressed in versions 9.27-2.fc29, 9.27-2.fc30, 9.27-2.fc31

• https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f

• Security restrictions bypass in Ghostscript
• Ubuntu update for Ghostscript
• Red Hat update for ghostscript
• Red Hat update for ghostscript
• OpenSUSE Linux update for ghostscript
• OpenSUSE Linux update for ghostscript
• Red Hat Enterprise Linux 8.0 (Services for SAP Solutions) update for ghostscript
• Code Injection in ghostscript (Alpine package)
• Fedora 31 update for ghostscript
• Fedora 30 update for ghostscript
• Fedora 29 update for ghostscript