Login Sign Up

CVE-2019-25059

7.8 HIGH
Remote Code Execution

📋 TL;DR

Artifex Ghostscript through version 9.26 contains a vulnerability in its .completefont handling that could allow arbitrary code execution. This affects systems using Ghostscript for PDF/PostScript processing, particularly web applications that process user-uploaded files. The vulnerability exists due to an incomplete fix for CVE-2019-3839.

💻 Affected Systems

Products:
  • Artifex Ghostscript
Versions: All versions through 9.26
Operating Systems: Linux, Windows, macOS, BSD
Default Config Vulnerable: ⚠️ Yes
Notes: Any system using Ghostscript for PDF/PostScript processing, including web applications, document management systems, and print servers.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Ghostscript by Artifex

View all CVEs affecting Ghostscript →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with the privileges of the Ghostscript process, potentially leading to complete system compromise.

🟠

Likely Case

Denial of service or limited code execution in sandboxed environments.

🟢

If Mitigated

No impact if proper input validation and sandboxing are implemented.

🌐 Internet-Facing: HIGH - Web applications processing user-uploaded PDFs/PostScript files are directly exposed.
🏢 Internal Only: MEDIUM - Internal systems processing PDFs could be exploited via phishing or malicious documents.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires processing a malicious PDF/PostScript file. No public exploit code is known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 9.27 and later

Vendor Advisory: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=430e219ea17a2650577d70021399c4ead05869e0

Restart Required: Yes

Instructions:

1. Update Ghostscript to version 9.27 or later. 2. For Linux: Use package manager (apt-get upgrade ghostscript, yum update ghostscript). 3. For Windows: Download latest installer from Artifex website. 4. Restart services using Ghostscript.

🔧 Temporary Workarounds

Disable PS/PDF processing

all

Temporarily disable Ghostscript processing of untrusted files

# Configure applications to reject PDF/PS files
# Use alternative PDF processors

Sandbox Ghostscript

linux

Run Ghostscript in a container or with reduced privileges

docker run --security-opt no-new-privileges ghostscript
chroot /safe/path gs

🧯 If You Can't Patch

  • Implement strict input validation to reject suspicious PDF/PostScript files
  • Isolate Ghostscript processes using containerization or virtualization

🔍 How to Verify

Check if Vulnerable:

Check Ghostscript version: gs --version. If version is 9.26 or earlier, system is vulnerable.

Check Version:

gs --version

Verify Fix Applied:

After update, verify version is 9.27 or later: gs --version

📡 Detection & Monitoring

Log Indicators:

  • Ghostscript crashes
  • Unusual process spawning from gs process
  • High memory usage by Ghostscript

Network Indicators:

  • Unexpected outbound connections from Ghostscript process

SIEM Query:

process_name:gs AND (event_type:crash OR parent_process:unusual)

📊 Metadata

CVE ID: CVE-2019-25059
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: April 25, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON