Bugzilla – Bug 1156275
VUL-0: CVE-2019-14869: ghostscript: -dSAFER bypass
Last modified: 2020-06-12 20:54:41 UTC
This is to privately disclose CVE-2019-14869 : "-dSAFER escape in .charkeys" This is another instance of a highly priviledged operator being accessible by specially crafted Postscript code, that can be used to break out of the -dSAFER limitations. It was found that `.forceput` operator was present and unprotected in the `.charkeys` method and could be retrieved via manipulation of the error handler. The method can be called from `.loadfontfile`. The `.charkeys` method was vulnerable since ghostscript-9.15, in one way or another: the privileged operator was `superexec` instead of `.forceput` until a more recent version. Upstream fix: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f Disclosure date : Thursday 2019/11/14, at around 1PM UTC. Upstream bug report (currently private): https://bugs.ghostscript.com/show_bug.cgi?id=701841 Red Hat would like to thank upstream, Artifex, for alerting us about the flaw. The vulnerability was originally reported by Paul Manfred & Lukas Schauer. Note: similarly to other recent ghostscript vulnerabilities, this one is mitigated by the recent -dSAFER rework. However, ghostscript-9.27 and older are fully impacted.
public via oss-security
SUSE-SU-2019:2981-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156275 CVE References: CVE-2019-14869 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): ghostscript-mini-9.27-3.24.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): ghostscript-mini-9.27-3.24.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): ghostscript-9.27-3.24.1 SUSE Linux Enterprise Module for Basesystem 15 (src): ghostscript-9.27-3.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2983-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156275 CVE References: CVE-2019-14869 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): ghostscript-9.27-23.31.1 SUSE OpenStack Cloud 8 (src): ghostscript-9.27-23.31.1 SUSE OpenStack Cloud 7 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server for SAP 12-SP1 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP5 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP4 (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): ghostscript-9.27-23.31.1 SUSE Linux Enterprise Desktop 12-SP4 (src): ghostscript-9.27-23.31.1 SUSE Enterprise Storage 5 (src): ghostscript-9.27-23.31.1 HPE Helion Openstack 8 (src): ghostscript-9.27-23.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2534-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156275 CVE References: CVE-2019-14869 Sources used: openSUSE Leap 15.0 (src): ghostscript-9.27-lp150.2.26.1, ghostscript-mini-9.27-lp150.2.26.1
openSUSE-SU-2019:2535-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156275 CVE References: CVE-2019-14869 Sources used: openSUSE Leap 15.1 (src): ghostscript-9.27-lp151.3.9.1, ghostscript-mini-9.27-lp151.3.9.1
released