Two weeks after the of the previous critical issue, there are another 4 similar vulnerabilities (CVE-2019-14811, CVE-2019-14812, CVE-2019-14813, CVE-2019-14817) that allow bypassing the isolation mode '-dSAFER' by creating a link to '.forceput'. When processing specially crafted documents, an attacker can gain access to the file system contents and achieve arbitrary code execution in the system (for example, by adding commands to ~/ .bashrc or ~/ .profile). A fix is available in the form of patches ( ). You can track the release of package updates in the distributions on the following pages:, Two weeks after the discovery of the previous critical issue, , , , , , , , .
It should be noted that vulnerabilities in Ghostscript pose a heightened risk, as this package is used in many popular applications for processing PostScript and PDF formats. For instance, Ghostscript is invoked during thumbnail creation on the desktop, during background data indexing, and when converting images. In many cases, a successful attack may only require uploading a file with an exploit or viewing a directory containing it in Nautilus. Vulnerabilities in Ghostscript can also be exploited via image handlers based on ImageMagick and GraphicsMagick by passing a JPEG or PNG file that contains PostScript code instead of an image (this file will be processed in Ghostscript since the MIME type is recognized by content rather than relying on the extension).
Source: opennet.ru
