CVE-2019-14817

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.50

Description A flaw in the .pdfexectoken procedure and other areas of Ghostscript allows scripts to bypass -dSAFER restrictions, enabling access to the file system or execution of arbitrary commands through a specially crafted PostScript file. This issue is related to insufficient access control, which can be exploited by a remote attacker to execute commands or access the file system, bypassing the restrictions imposed by -dSAFER.

Recommendations For Ghostscript versions prior to 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the .pdfexectoken procedure and other affected areas until a patch is applied. Avoid using the -dSAFER restriction with untrusted PostScript files until the issue is resolved.