Arch Linux Security Advisory ASA-201904-5 ========================================= Severity: High Date : 2019-04-11 CVE-ID : CVE-2019-3835 CVE-2019-3838 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-929 Summary ======= The package ghostscript before version 9.27-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.27-1. # pacman -Syu "ghostscript>=9.27-1" The problems have been fixed upstream in version 9.27. Workaround ========== None. Description =========== - CVE-2019-3835 (sandbox escape) It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. - CVE-2019-3838 (sandbox escape) It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://bugs.archlinux.org/task/62102 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a https://security.archlinux.org/CVE-2019-3835 https://security.archlinux.org/CVE-2019-3838