Errata overview
Errata ID 255
Date 2019-09-11
Source package ghostscript
Fixed in version 9.26a~dfsg-0+deb9u5
Description
This update addresses the following issues:
* A flaw was found in in the .pdf_hook_DSC_Creator procedure where it did not
  properly secure its privileged calls, enabling scripts to bypass `-dSAFER`
  restrictions. A specially crafted PostScript file could disable security
  protection and then have access to the file system, or execute arbitrary
  commands. (CVE-2019-14811)
* A flaw was found in the .setuserparams2 procedure where it did not properly
  secure its privileged calls, enabling scripts to bypass `-dSAFER`
  restrictions. A specially crafted PostScript file could disable security
  protection and then have access to the file system, or execute arbitrary
  commands. (CVE-2019-14812)
* A flaw was found in the setsystemparams procedure where it did not properly
  secure its privileged calls, enabling scripts to bypass `-dSAFER`
  restrictions. A specially crafted PostScript file could disable security
  protection and then have access to the file system, or execute arbitrary
  commands. (CVE-2019-14813)
* A flaw was found in the .pdfexectoken and other procedures where it did not
  properly secure its privileged calls, enabling scripts to bypass `-dSAFER`
  restrictions. A specially crafted PostScript file could disable security
  protection and then have access to the file system, or execute arbitrary
  commands. (CVE-2019-14817)
Additional notes
CVE ID CVE-2019-14811
CVE-2019-14812
CVE-2019-14813
CVE-2019-14817
UCS Bug number #50149