CVE-2019-14813
📋 TL;DR
This vulnerability in Ghostscript versions 9.x before 9.50 allows specially crafted PostScript files to bypass the -dSAFER security sandbox. Attackers can gain file system access or execute arbitrary commands. Any system processing untrusted PostScript files with vulnerable Ghostscript is affected.
💻 Affected Systems
- Ghostscript
- Applications using Ghostscript libraries (ImageMagick, LibreOffice, etc.)
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Ghostscript by Artifex
Leap by Opensuse
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
File system access allowing data exfiltration or privilege escalation.
If Mitigated
Limited impact if proper input validation and sandboxing are enforced.
🎯 Exploit Status
Exploitation requires delivering a malicious PostScript file to a vulnerable system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.50 or later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:2594
Restart Required: No
Instructions:
1. Update Ghostscript to version 9.50 or later using your package manager.
2. For Linux: 'sudo apt update && sudo apt upgrade ghostscript' (Debian/Ubuntu) or 'sudo yum update ghostscript' (RHEL/CentOS).
3. Verify the update with 'gs --version'.
4. Update any applications that bundle Ghostscript libraries.
🔧 Temporary Workarounds
Disable PostScript processing
allConfigure applications to disable Ghostscript processing of PostScript files.
For ImageMagick: edit policy.xml to remove PS, EPS, PDF delegates
Use -dSAFER with additional restrictions
allApply stricter sandboxing where possible, though this vulnerability bypasses -dSAFER.
gs -dSAFER -dNOPAUSE -dBATCH -sDEVICE=... input.ps
🧯 If You Can't Patch
- Isolate systems processing untrusted documents in a restricted network segment.
- Implement strict file upload validation to block PostScript files or sanitize inputs.
🔍 How to Verify
Check if Vulnerable:
Run 'gs --version' and check if version is below 9.50.Check Version:
gs --versionVerify Fix Applied:
Confirm 'gs --version' returns 9.50 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual Ghostscript process execution patterns
- Errors from PostScript file processing
Network Indicators:
- Unexpected outbound connections from document processing servers
SIEM Query:
process_name:"gs" AND (command_line:"-dSAFER" OR command_line:"PostScript")🔗 References
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2594
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813
- https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/
- https://seclists.org/bugtraq/2019/Sep/15
- https://security.gentoo.org/glsa/202004-03
- https://www.debian.org/security/2019/dsa-4518
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2594
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813
- https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/
- https://seclists.org/bugtraq/2019/Sep/15
- https://security.gentoo.org/glsa/202004-03
- https://www.debian.org/security/2019/dsa-4518
