CVE-2019-10216

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.50

Description The issue is related to the .buildfont1 procedure in Ghostscript, which did not properly secure its privileged calls, allowing scripts to bypass -dSAFER restrictions. An attacker could exploit this flaw by creating a specially crafted PostScript file to escalate privileges and access files outside of restricted areas. This could potentially be used to execute arbitrary code in the system.

Recommendations For Ghostscript versions prior to 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the .buildfont1 procedure until a patch is available. Avoid processing specially crafted PostScript files that could exploit this vulnerability.