CVE-2019-14812

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

• CWE-648
• CWE-732

• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33
• https://access.redhat.com/security/cve/cve-2019-14812Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=701444Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14812Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
• https://security.gentoo.org/glsa/202004-03Third Party Advisory
• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33
• https://access.redhat.com/security/cve/cve-2019-14812Third Party Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=701444Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14812Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
• https://security.gentoo.org/glsa/202004-03Third Party Advisory

Published

Nov 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14807In the MobileFrontend extension 1.31 through 1.33 for MediaW…6.1
• CVE-2019-14808An issue was discovered in the RENPHO application 3.0.0 for …6.8
• CVE-2019-14809net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishan…
• CVE-2019-1481An information disclosure vulnerability exists in Windows Me…4.3
• CVE-2019-14810A vulnerability has been found in the implementation of the …5.9
• CVE-2019-14811A flaw was found in, ghostscript versions prior to 9.50, in …7.8
• CVE-2019-14813A flaw was found in ghostscript, versions 9.x before 9.50, i…9.8
• CVE-2019-14814There is heap-based buffer overflow in Linux kernel, all ver…7.8
• CVE-2019-14815A vulnerability was found in Linux Kernel, where a Heap Over…7.8
• CVE-2019-14816There is heap-based buffer overflow in kernel, all versions …7.8
• CVE-2019-14817A flaw was found in, ghostscript versions prior to 9.50, in …7.8
• CVE-2019-14818A flaw was found in all dpdk version 17.x.x before 17.11.8, …7.5