MGASA-2019-0130

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2019-0130.html
Import Source
https://advisories.mageia.org/MGASA-2019-0130.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2019-0130
Related
Published
2019-04-05T18:12:59Z
Modified
2019-04-05T17:37:07Z
Summary
Updated ghostscript packages fix security vulnerability
Details

It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3835)

It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constraints imposed by -dSAFER. (CVE-2019-3838)

References
Credits

Affected packages

Mageia:6 / ghostscript

Package

Name
ghostscript
Purl
pkg:rpm/mageia/ghostscript?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.26-1.3.mga6

Ecosystem specific 

{
    "section": "core"
}