遠端主機受到 GLSA-202004-03 中所述的弱點影響 (GPL Ghostscript：多個弱點)

    在 GPL Ghostscript 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    遠端攻擊者可引誘使用者透過 GPL Ghostscript 處理特製檔案，並可能藉此以處理程序的權限執行任意程式碼，或導致拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

- Fix for CVE-2019-10216 added

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following issues :

Security issue fixed :

  - CVE-2019-10216: Fix privilege escalation via specially     crafted PostScript file (bsc#1144621).

This update was imported from the SUSE:SLE-15:Update update project.

Security Fix(es) :

  - ghostscript: -dSAFER escape via .buildfont1 (701394)     (CVE-2019-10216)

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977. (CVE-2018-11645)

  - A flaw was found in ghostscript, versions 9.x before     9.28, in the setsystemparams procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14813)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdf_hook_DSC_Creator procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14811)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdfexectoken and other procedures where it did     not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security     protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0123 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10216:
    In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a     specially crafted PostScript file that could escalate privileges and access files outside of restricted     areas.

    CVE-2019-14811:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14812:
    A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14813:
    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did     not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security protection and then have access to the file system, or     execute arbitrary commands.

    CVE-2019-14817:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where     it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14869:
    A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate     privileges within the Ghostscript and access files outside of restricted areas or execute commands.

    CVE-2019-3835:
    It was found that the superexec operator was available in the internal dictionary in ghostscript before     9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the     file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3838:
    It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3839:
    It was found that in ghostscript some privileged operators remained accessible from various places after     the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before     9.27 are vulnerable.

    CVE-2019-6116:
    In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system     operators, leading to remote code execution.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2465 advisory.

    [9.25-2.2]
    - Resolves: #1737336 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2462 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: -dSAFER escape via .buildfont1 (701394) (CVE-2019-10216)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following issues :

Security issue fixed :

CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Artifex Ghostscript installed on the remote Windows host is prior to 9.50. It is, therefore, affected by multiple security bypass vulnerabilities. An attacker could exploit one of these vulnerabilities to gain access to the file system and execute arbitrary commands.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977. (CVE-2018-11645)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted areas.
    (CVE-2019-10216)

  - A flaw was found in ghostscript, versions 9.x before     9.50, in the setsystemparams procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14813)

  - A flaw was found in all ghostscript versions 9.x before     9.50, in the .setuserparams2 procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14812)

  - A flaw was found in, ghostscript versions prior to 9.50,     in the .pdf_hook_DSC_Creator procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14811)

  - A flaw was found in, ghostscript versions prior to 9.50,     in the .pdfexectoken and other procedures where it did     not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security     protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The PS Interpreter in Ghostscript 9.18 and 9.20 allows     remote attackers to execute arbitrary code via crafted     userparams.(CVE-2016-7976)

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977.(CVE-2018-11645)

  - A flaw was found in the .pdfexectoken and other     procedures where it did not properly secure its     privileged calls, enabling scripts to bypass `-dSAFER`     restrictions. A specially crafted PostScript file could     disable security protection and then have access to the     file system, or execute arbitrary     commands.(CVE-2019-14817)

  - A flaw was found in the setsystemparams procedure where     it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14813)

  - A flaw was found in the .setuserparams2 procedure where     it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14812)

  - A flaw was found in the .pdf_hook_DSC_Creator procedure     where it did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable     security protection and then have access to the file     system, or execute arbitrary commands.(CVE-2019-14811)

  - libjbig2dec.a in Artifex jbig2dec 0.13, as used in     MuPDF and Ghostscript, has a NULL pointer dereference     in the jbig2_huffman_get function in jbig2_huffman.c.
    For example, the jbig2dec utility will crash     (segmentation fault) when parsing an invalid     file.(CVE-2017-9216)

  - Artifex jbig2dec 0.13, as used in Ghostscript, allows     out-of-bounds writes because of an integer overflow in     the jbig2_build_huffman_table function in     jbig2_huffman.c during operations on a crafted JBIG2     file, leading to a denial of service (application     crash) or possibly execution of arbitrary     code.(CVE-2017-7975)

  - Artifex jbig2dec 0.13 has a heap-based buffer over-read     leading to denial of service (application crash) or     disclosure of sensitive information from process     memory, because of an integer overflow in the     jbig2_decode_symbol_dict function in     jbig2_symbol_dict.c in libjbig2dec.a during operation     on a crafted .jb2 file.(CVE-2017-7885)

  - Artifex jbig2dec 0.13 allows out-of-bounds writes and     reads because of an integer overflow in the     jbig2_image_compose function in jbig2_image.c during     operations on a crafted .jb2 file, leading to a denial     of service (application crash) or disclosure of     sensitive information from process     memory.(CVE-2017-7976)

  - ghostscript before version 9.21 is vulnerable to a heap     based buffer overflow that was found in the ghostscript     jbig2_decode_gray_scale_image function which is used to     decode halftone segments in a JBIG2 image. A document     (PostScript or PDF) with an embedded, specially     crafted, jbig2 image could trigger a segmentation fault     in ghostscript.(CVE-2016-9601)

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135114	GLSA-202004-03：GPL Ghostscript：多個弱點	Nessus	Gentoo Local Security Checks	2020/4/2	2024/3/20	critical
128041	Fedora 30 : ghostscript (2019-93e0145607)	Nessus	Fedora Local Security Checks	2019/8/21	2020/8/21	high
128869	openSUSE Security Update : ghostscript (openSUSE-2019-2139)	Nessus	SuSE Local Security Checks	2019/9/16	2020/8/21	high
128273	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190812)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2020/8/21	high
133901	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2020-1100)	Nessus	Huawei Local Security Checks	2020/2/24	2024/3/26	high
129908	NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0203)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2021/7/5	critical
131503	EulerOS Virtualization for ARM 64 3.0.3.0 : ghostscript (EulerOS-SA-2019-2338)	Nessus	Huawei Local Security Checks	2019/12/3	2021/1/6	high
236536	Alibaba Cloud Linux 3 : 0123: ghostscript (ALINUX3-SA-2022:0123)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
127980	Oracle Linux 8 : ghostscript (ELSA-2019-2465)	Nessus	Oracle Linux Local Security Checks	2019/8/20	2024/10/22	high
127831	RHEL 7 : ghostscript (RHSA-2019:2462)	Nessus	Red Hat Local Security Checks	2019/8/13	2024/11/6	high
136252	EulerOS Virtualization for ARM 64 3.0.2.0 : ghostscript (EulerOS-SA-2020-1549)	Nessus	Huawei Local Security Checks	2020/5/1	2024/3/13	high
128678	SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2019:2348-1)	Nessus	SuSE Local Security Checks	2019/9/11	2021/1/13	high
130273	Artifex Ghostscript < 9.50 Multiple Vulnerabilities	Nessus	Windows	2019/10/25	2021/7/5	critical
132453	NewStart CGSL CORE 5.05 / MAIN 5.05 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0250)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2021/7/5	critical
135661	EulerOS Virtualization 3.0.2.2 : ghostscript (EulerOS-SA-2020-1499)	Nessus	Huawei Local Security Checks	2020/4/16	2025/5/7	critical

检测

插件搜索

critical

high

high

high

high

critical

high

critical

high

high

high

high

critical

critical

critical