CVE-2019-14817CWE-648

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls…

High · published September 3, 2019

CVSS v3.0
7.3
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02025 · 80.8th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2019-09-03T15:50Z
EPSS history
Timeline
  • 03 SEP 15:50Z
    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls…
    cvelistv5