Vulnerability CVE-2019-6116


Published: 2019-03-21

Description:
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.

Type:

CWE-20

(Improper Input Validation)

Vendor: Artifex
Product: Ghostscript 
Version: 9.26;
Vendor: Debian
Product: Debian linux 
Version: 9.0; 8.0;
Vendor: Redhat
Product: Enterprise linux server eus 
Version: 7.6;
Product: Enterprise linux server aus 
Version: 7.6;
Product: Enterprise linux server tus 
Version: 7.6;
Product: Enterprise linux server 
Version: 7.0;
Product: Enterprise linux workstation 
Version: 7.0;
Product: Enterprise linux desktop 
Version: 7.0;
Vendor: Opensuse
Product: LEAP 
Version: 42.3; 15.0;
Vendor: Fedoraproject
Product: Fedora 
Version: 29; 28;
Vendor: Canonical
Product: Ubuntu linux 
Version:
18.10
18.04
16.04
14.04

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00048.html
http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html
http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html
http://www.openwall.com/lists/oss-security/2019/01/23/5
http://www.openwall.com/lists/oss-security/2019/03/21/1
http://www.securityfocus.com/bid/106700
https://access.redhat.com/errata/RHSA-2019:0229
https://bugs.chromium.org/p/project-zero/issues/detail?id=1729
https://bugs.ghostscript.com/show_bug.cgi?id=700317
https://lists.debian.org/debian-lts-announce/2019/02/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7N6T5L3SSJX2AVUPHP7GCPATFWUPKZT2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWVAVCDXBLPLJMVGNSKGGDTBEOHCJBKK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVWXVKG72IGEJYHLWE6H3CGALHGFSGGY/
https://seclists.org/bugtraq/2019/Apr/4
https://usn.ubuntu.com/3866-1/
https://www.debian.org/security/2019/dsa-4372
https://www.exploit-db.com/exploits/46242/

Related CVE
CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly i...
CVE-2019-3460
A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.
CVE-2019-3459
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.
CVE-2019-0816
A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
CVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with...
CVE-2019-0217
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictio...
CVE-2018-3979
A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution. A specially crafted pixel shader can cause remote denial-of-service issues. An attacker can...
CVE-2019-8956
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.

Copyright 2019, cxsecurity.com

 

Back to Top