CVE-2019-10216: artifex ghostscript Incorrect Use of Privileged APIs

Vulnerability summary

CVE-2019-10216 is a high (CVSS 7.8) Incorrect Use of Privileged APIs vulnerability in artifex ghostscript. EPSS estimates a 2.30% chance of exploitation in the next 30 days, higher than 83% of scored vulnerabilities.

Timeline

1. 27-11-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

• CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.