CVE-2019-14812CWE-648

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling…

High · published November 27, 2019

CVSS v3.0
7.3
EPSS
2%
Percentile
84.4
In the wild
Unconfirmed
What it is

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02473 · 84.4th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2019-11-27T13:50Z
EPSS history
Timeline
  • 27 NOV 13:50Z
    A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling…
    cvelistv5