This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-3835 →

DEBIAN-CVE-2019-3835

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file coul...

Original description

The description as published by the source.

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ghostscript

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]

Debian:13 ghostscript

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]

Debian:14 ghostscript

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]

References

advisory security-tracker.debian.org