CVE-2019-3835CWE-648

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27

High · published March 25, 2019

CVSS v3.0
7.3
EPSS
2%
Percentile
84.4
In the wild
Unconfirmed
What it is

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02473 · 84.4th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2019-03-25T18:30Z
EPSS history
Timeline
  • 25 MAR 18:30Z
    It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27
    cvelistv5