Netanel 報告 Ghostscript (GPL PostScript/PDF 解譯程式) 中的 .buildfont1 程序未正確限制特權呼叫，這可導致繞過 dSAFER 沙箱的檔案系統限制。

Netanel Fisher 發現 Ghostscript 中的字型處理常式在 '-dSAFER' 限制生效時，未正確限制具權限的呼叫。如果使用者或自動化系統遭誘騙而處理特製的檔案，遠端攻擊者可能會利用此問題存取任意檔案。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Netanel 報告 Ghostscript (GPL PostScript/PDF 解譯程式) 中的 .buildfont1 程序未正確限制特權呼叫，這可導致繞過 dSAFER 沙箱的檔案系統限制。針對 Debian 8「Jessie」，此問題已在 9.26a~dfsg-0+deb8u4 版本中修正。建議您升級 ghostscript 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機受到 GLSA-202004-03 中所述的弱點影響 (GPL Ghostscript：多個弱點)

    在 GPL Ghostscript 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    遠端攻擊者可引誘使用者透過 GPL Ghostscript 處理特製檔案，並可能藉此以處理程序的權限執行任意程式碼，或導致拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

Netanel 报告，GPL PostScript/PDF 解释器 Ghostscript 中的 .buildfont1 进程未正确限制特权调用，这些漏洞可能导致绕过 dSAFER 沙盒的文件系统限制。对于 Debian 8“Jessie”，这一问题已在 9.26a~dfsg-0+deb8u4 版本中修复。我们建议您升级 ghostscript 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

Netanel 报告，GPL PostScript/PDF 解释器 Ghostscript 中的 .buildfont1 进程未正确限制特权调用，这些漏洞可能导致绕过 dSAFER 沙盒的文件系统限制。

Netanel Fisher 发现 Ghostscript 中的字体处理程序在 '-dSAFER' 限制生效时，未正确限制具权限的调用。如果用户或自动化系统受到诱骗处理特制的文件，远程攻击者可能利用此问题访问任意文件。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程主机受到 GLSA-202004-03 中所述漏洞的影响（GPL Ghostscript：多个漏洞）

    已在 GPL Ghostscript 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    远程攻击者可引诱用户使用 GPL Ghostscript 处理特别构建的文件，这可能导致以进程权限执行任意代码或拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - psi/zfile.c in Artifex Ghostscript before 9.21rc1     permits the status command even if -dSAFER is used,     which might allow remote attackers to determine the     existence and size of arbitrary files, a similar issue     to CVE-2016-7977. (CVE-2018-11645)

  - A flaw was found in ghostscript, versions 9.x before     9.28, in the setsystemparams procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14813)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdf_hook_DSC_Creator procedure where it did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. A specially crafted     PostScript file could disable security protection and     then have access to the file system, or execute     arbitrary commands. (CVE-2019-14811)

  - A flaw was found in, ghostscript versions prior to 9.28,     in the .pdfexectoken and other procedures where it did     not properly secure its privileged calls, enabling     scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security     protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - ghostscript: -dSAFER escape via .buildfont1 (701394)     (CVE-2019-10216)

This update for ghostscript fixes the following issues :

Security issue fixed :

  - CVE-2019-10216: Fix privilege escalation via specially     crafted PostScript file (bsc#1144621).

This update was imported from the SUSE:SLE-15:Update update project.

- Fix for CVE-2019-10216 added

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
127823	Debian DSA-4499-1：ghostscript - 安全性更新	Nessus	Debian Local Security Checks	2019/8/13	2020/8/21	high
127840	Ubuntu 16.04 LTS / 18.04 LTS：Ghostscript 弱點 (USN-4092-1)	Nessus	Ubuntu Local Security Checks	2019/8/13	2023/10/20	high
127862	Debian DLA-1880-1：ghostscript 安全性更新	Nessus	Debian Local Security Checks	2019/8/14	2021/1/11	high
135114	GLSA-202004-03：GPL Ghostscript：多個弱點	Nessus	Gentoo Local Security Checks	2020/4/2	2024/3/20	critical
127862	Debian DLA-1880-1：ghostscript - 安全更新	Nessus	Debian Local Security Checks	2019/8/14	2021/1/11	high
127823	Debian DSA-4499-1：ghostscript 安全更新	Nessus	Debian Local Security Checks	2019/8/13	2020/8/21	high
127840	Ubuntu 16.04 LTS / 18.04 LTS：Ghostscript 漏洞 (USN-4092-1)	Nessus	Ubuntu Local Security Checks	2019/8/13	2023/10/20	high
135114	GLSA-202004-03 ：GPL Ghostscript：多个漏洞	Nessus	Gentoo Local Security Checks	2020/4/2	2024/3/20	critical
129908	NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0203)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2021/7/5	critical
133901	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2020-1100)	Nessus	Huawei Local Security Checks	2020/2/24	2024/3/26	high
131503	EulerOS Virtualization for ARM 64 3.0.3.0 : ghostscript (EulerOS-SA-2019-2338)	Nessus	Huawei Local Security Checks	2019/12/3	2021/1/6	high
128273	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190812)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2020/8/21	high
128869	openSUSE Security Update : ghostscript (openSUSE-2019-2139)	Nessus	SuSE Local Security Checks	2019/9/16	2020/8/21	high
128041	Fedora 30 : ghostscript (2019-93e0145607)	Nessus	Fedora Local Security Checks	2019/8/21	2020/8/21	high

偵測

搜尋 Plugin

high

high

high

critical

high

high

high

critical

critical

high

high

high

high

high