CVE-2019-3839

HIGH 7.8CVE-2019-3839 · Published 16/05/2019 · updated 17/06/2026

In short

CVE-2019-3839 is a HIGH (CVSS 7.8) vulnerability affecting ghostscript (artifex).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.3% of all vulnerabilities.
Fix: update to 9.27 or later.

Package	Affected versions	Patched versions
ghostscript artifex	`< 9.27`	`9.27`

Description

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.

References

git.ghostscript.com
lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html · Mailing List
access.redhat.com/errata/RHSA-2019:0971 · Third Party Advisory
access.redhat.com/errata/RHSA-2019:1017 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2019/05/msg00023.html · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A
seclists.org/bugtraq/2019/May/23 · Mailing List
usn.ubuntu.com/3970-1 · Third Party Advisory
debian.org/security/2019/dsa-4442 · Third Party Advisory

More vulnerabilities in ghostscript

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free