CVE-2019-14811CWE-648

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling…

High · published September 3, 2019

CVSS v3.0
7.3
EPSS
4%
Percentile
89.8
In the wild
Unconfirmed
What it is

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03746 · 89.8th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2019-09-03T15:17Z
EPSS history
Timeline
  • 03 SEP 15:17Z
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling…
    cvelistv5