Skip to content
Fencer Intel
high 7.8

CVE-2019-6116 in the critical feed json

In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code executi…

published 7y ago modified 4mo ago also EUVD-2019-15683

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
41.6%
EPSS 41.6% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.

Patch / fix

  • ghostscript Debian 14, Debian 13, Debian 12 9.26a~dfsg-1

debian advisories DEBIAN-CVE-2019-6116

  • ghostscript Ubuntu 14.04 LTS 9.26~dfsg+0-0ubuntu0.14.04.4
  • ghostscript Ubuntu 16.04 LTS 9.26~dfsg+0-0ubuntu0.16.04.4
  • ghostscript Ubuntu 18.04 LTS 9.26~dfsg+0-0ubuntu0.18.04.4

ubuntu advisories UBUNTU-CVE-2019-6116

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript RHEL 7 9.07-31.el7_6.9
  • ghostscript-gtk RHEL 7 9.07-31.el7_6.9
  • ghostscript-cups RHEL 7 9.07-31.el7_6.9

red hat advisories RHSA-2019:0229

  • ghostscript SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 9.26a-23.19.1
  • libspectre SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 0.2.7-12.6.1
  • ghostscript SLE Module for Basesystem 15 9.26a-3.12.1
  • libspectre SLE Module for Desktop Applications 15 0.2.8-3.6.1

suse advisories SUSE-SU-2019:0144-2SUSE-SU-2019:0145-1SUSE-SU-2019:0144-1

  • ghostscript openSUSE Tumbleweed 9.54.0-2.2
  • ghostscript openSUSE Leap 15.0 9.26a-lp150.2.12.1
  • ghostscript-mini openSUSE Leap 15.0 9.26a-lp150.2.12.1

opensuse advisories openSUSE-SU-2024:10783-1openSUSE-SU-2019:0104-1

  • ghostscript Alpine 3.12, Alpine 3.11, Alpine 3.10 +4 more 9.26-r2
  • ghostscript Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 9.26-r1

alpine advisories ALPINE-CVE-2019-6116

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript Arch Linux 9.26-2

arch linux advisories AVG-860

Is CVE-2019-6116 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-6116 updated cvss 7.3

ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)

  • Red Hat Enterprise Linux 5 ghostscript Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk
    affected: workaround, no fix planned “Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509”
  • Red Hat Enterprise Linux Client (v. 7) ghostscript 9.07-31.el7_6.9, ghostscript-cups 9.07-31.el7_6.9 Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-gtk 9.07-31.el7_6.9 Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript 9.07-31.el7_6.9, ghostscript-cups 9.07-31.el7_6.9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-gtk 9.07-31.el7_6.9 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ghostscript 9.07-31.el7_6.9, ghostscript-cups 9.07-31.el7_6.9 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) ghostscript-gtk 9.07-31.el7_6.9
    +4 more products
    Red Hat Enterprise Linux Server (v. 7) ghostscript 9.07-31.el7_6.9, ghostscript-cups 9.07-31.el7_6.9 Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-gtk 9.07-31.el7_6.9 Red Hat Enterprise Linux Workstation (v. 7) ghostscript 9.07-31.el7_6.9, ghostscript-cups 9.07-31.el7_6.9 Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-gtk 9.07-31.el7_6.9
    fixed: vendor fix “Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509” RHSA-2019:0229
  • Red Hat Enterprise Linux 8 libgs, ghostscript, ghostscript-x11, ghostscript-tools-fonts, ghostscript-tools-dvipdf, ghostscript-tools-printing
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-46242)
  2. Published

Exploit prediction

41.59% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-46242 Ghostscript 9.26 - Pseudo-Operator Remote Code Execution remote, 2019-01-24
  • bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=1729 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2019/01/23/5 referenced PoC, tagged "exploit" by a source, unverified
  • bugs.ghostscript.com https://bugs.ghostscript.com/show_bug.cgi?id=700317 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.