What’s Vulnerable › Vulnerabilities
CVE-2019-3835
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-03-25 · updated 2026-06-17
- Weakness: CWE-648
Description
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Affected products
- Artifex Ghostscript: before 9.27 — fixed in 9.27
- Debian Linux: 8.0, 9.0
- Fedoraproject Fedora: 28, 29, 30
- openSUSE Leap: 15.0, 15.1
- Tower: 3.3
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.6
- RedHat Enterprise Linux Server Eus: 7.6
- RedHat Enterprise Linux Server Tus: 7.6
- RedHat Enterprise Linux Workstation: 7.0
How to fix
Upgrade to a fixed version: Artifex Ghostscript 9.27. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
- http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html
- http://www.securityfocus.com/bid/107855
- https://access.redhat.com/errata/RHSA-2019:0652
- https://access.redhat.com/errata/RHSA-2019:0971
- https://bugs.ghostscript.com/show_bug.cgi?id=700585
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3835
- https://lists.debian.org/debian-lts-announce/2019/04/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A43SRQAEHQCKSEMIBINHUNIGHTDCZD7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANBSCZABXQUEQWIKNWJ35IYX24M227EI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVERLGEU3OV6RNZ2SIBXREWD3BF5H23N/
Get alerted when CVE-2019-3835 or the next vulnerability affects your stack