This update for ghostscript fixes the following issue :

Security issue fixed :

  - CVE-2019-3838: Fixed a vulnerability which made forceput     operator in DefineResource to be still accessible which     could allow access to file system outside of the     constraints of -dSAFER (bsc#1129186).

This update was imported from the SUSE:SLE-15:Update update project.

- Security fix for CVE-2019-3835 CVE-2019-3838

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0123 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10216:
    In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged     calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a     specially crafted PostScript file that could escalate privileges and access files outside of restricted     areas.

    CVE-2019-14811:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14812:
    A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14813:
    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did     not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security protection and then have access to the file system, or     execute arbitrary commands.

    CVE-2019-14817:
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where     it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands.

    CVE-2019-14869:
    A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate     privileges within the Ghostscript and access files outside of restricted areas or execute commands.

    CVE-2019-3835:
    It was found that the superexec operator was available in the internal dictionary in ghostscript before     9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the     file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3838:
    It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER.

    CVE-2019-3839:
    It was found that in ghostscript some privileged operators remained accessible from various places after     the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before     9.27 are vulnerable.

    CVE-2019-6116:
    In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system     operators, leading to remote code execution.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3838)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.06, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter     by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute     arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3781)

  - The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before     1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the     heap via malformed image files, as originally demonstrated using imagemagick convert. (CVE-2007-2721)

  - Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows     remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a     .seticcspace operator. (CVE-2008-0411)

  - Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2     decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to     execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length     value. (CVE-2009-0196)

  - Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka     icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and     earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and     application crash) or possibly execute arbitrary code by using a device file for a translation request     that operates on a crafted image file and targets a certain native color space, related to an ICC     profile in a (1) PostScript or (2) PDF file with embedded images. (CVE-2009-0583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
123668	openSUSE Security Update : ghostscript (openSUSE-2019-1121)	Nessus	SuSE Local Security Checks	2019/4/3	2024/6/6	medium
123763	Fedora 28 : ghostscript (2019-9f28451404)	Nessus	Fedora Local Security Checks	2019/4/5	2024/6/5	medium
236536	Alibaba Cloud Linux 3 : 0123: ghostscript (ALINUX3-SA-2022:0123)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
222919	Linux Distros Unpatched Vulnerability : CVE-2019-3838	Nessus	Misc.	2025/3/4	2026/9/2	medium
330512	NewStart CGSL MAIN 6.06 : ghostscript Multiple Vulnerabilities (NS-SA-2026-0055)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/30	critical

检测

插件搜索

medium

medium

critical

medium

critical