CVE-2019-10216

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-648

Affected software

Vendor	Product	Versions
ghostscript	ghostscript	before 9.50

References

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5b85ddd19
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10216Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202004-03Third Party Advisory
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5b85ddd19
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10216Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202004-03Third Party Advisory

Timeline

Published: Nov 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102176.5A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields CVE-2019-102186.5A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a path CVE-2019-102196.1A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potent CVE-2019-10227.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code CVE-2019-102208.8Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.CVE-2019-102216.1A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. CVE-2019-102227.5A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash CVE-2019-102236.5A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 releas CVE-2019-102244.6A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may di CVE-2019-102256.3A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently pr CVE-2019-102265.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOT CVE-2019-102276.1openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.