| Package | Affected versions | Patched versions |
|---|---|---|
| ghostscript | < 9.50 | 9.50 |
| 3scale api management | = 2.6 |
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free