CVE-2019-3839

Publication date 6 May 2019

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ghostscript	19.04 disco	Fixed 9.26~dfsg+0-0ubuntu7.1
	18.10 cosmic	Fixed 9.26~dfsg+0-0ubuntu0.18.10.9
	18.04 LTS bionic	Fixed 9.26~dfsg+0-0ubuntu0.18.04.9
	16.04 LTS xenial	Fixed 9.26~dfsg+0-0ubuntu0.16.04.9
	14.04 LTS trusty	Not in release

Notes

sbeattie

second commit avoids pdf2dsc regression

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ghostscript	Upstream: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9 Upstream: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=db24f253409d5d085c2760c814c3e1d3fa2dac59

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H