CVE-2019-14869: artifex ghostscript Incorrect Use of Privileged APIs
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2019-14869MGASA-2019-0336SUSE-SU-2019:2981-1SUSE-SU-2019:2983-1RHSA-2019:3888RHSA-2019:3890RHSA-2020:0222UBUNTU-CVE-2019-14869USN-4193-1DEBIAN-CVE-2019-14869DLA-1992-1DSA-4569-1openSUSE-SU-2019:2534-1openSUSE-SU-2019:2535-1
Published 15-11-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-14869 is a high (CVSS 8.8) Incorrect Use of Privileged APIs vulnerability in artifex ghostscript. EPSS estimates a 4.50% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
4.50%
0%100%
Low · +1.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 15-11-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.
CVSS metrics
9 scores · 6 sources · 3 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 7.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 4 agree
- NVDNIST7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · Red hatEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.50%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
+1.06 pp
From 3.43% on 20-09-2026
20-09-202620-10-2026
EPSS score4.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Suse22 products
- ghostscript&distro=HPE Helion OpenStack 8< 9.27-23.31.1
- ghostscript&distro=SUSE Enterprise Storage 5< 9.27-23.31.1
- ghostscript&distro=SUSE Linux Enterprise Desktop 12 SP4< 9.27-23.31.1
- ghostscript&distro=SUSE Linux Enterprise Module for Basesystem 15< 9.27-3.24.1
- ghostscript&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 9.27-3.24.1
Redhat15 products
- ghostscript< 0:9.25-2.el8_0.4 | < 0:9.25-2.el7_7.3 | < 0:9.25-5.el8_1.1
- ghostscript-cups< 0:9.25-2.el7_7.3
- ghostscript-debuginfo< 0:9.25-2.el8_0.4 | < 0:9.25-2.el7_7.3 | < 0:9.25-5.el8_1.1
- ghostscript-debugsource< 0:9.25-2.el8_0.4 | < 0:9.25-5.el8_1.1
- ghostscript-doc< 0:9.25-2.el7_7.3 | < 0:9.25-5.el8_1.1
Opensuse5 products
- leapEOL15.0 | 15.1
- ghostscript-mini&distro=openSUSE Leap 15.0< 9.27-lp150.2.26.1
- ghostscript-mini&distro=openSUSE Leap 15.1< 9.27-lp151.3.9.1
- ghostscript&distro=openSUSE Leap 15.0< 9.27-lp150.2.26.1
- ghostscript&distro=openSUSE Leap 15.1< 9.27-lp151.3.9.1
Alpine1 product
- ghostscript≥ 9.00, < 9.27-r5 | ≥ 9.00, < 9.50-r0 | ≥ 9.00, < 9.26-r5
Artifex1 product
- ghostscript≥ 9.00, < 9.50
Debian1 product
- ghostscript< 9.50~dfsg-3 | < 9.26a~dfsg-0+deb9u6 | < 9.27~dfsg-2+deb10u3 | < 9.26a~dfsg-0+deb8u6
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Ghostscript1 product
- ghostscriptall versions of ghostscript 9.x before 9.28
Mageia1 product
- ghostscript< 9.27-1.4.mga7
Ubuntu1 product
- ghostscript< 9.26~dfsg+0-0ubuntu0.16.04.12 | < 9.26~dfsg+0-0ubuntu0.18.04.12
10 vendors · 49 products
References
35 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14869X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2019/11/15/1Mailing ListX Refsource MLISTPatchThird Party Advisory
- git.ghostscript.com?p=ghostpdl.git%3Ba=commitdiff%3Bh=485904772c5fX Refsource CONFIRM
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00049.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00050.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 35 references
- access.redhat.com/errata/RHSA-2020:0222Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory