Every CVE Search/ Get API key

CVE-2019-10216

It was found that the .buildfont1 procedure did not properly secure its privileged calls,...

7.3 HighFix available

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.30%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.3

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
CVE-2019-10216
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-648
Updated
2026-11-02
EUVDEUVD-2019-2231 7.3

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
EUVD-2019-2231
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-9xw2-pr37-vhp5 7.8

It was found that the .buildfont1 procedure did not properly secure its privileged calls,...

It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
GHSA-9xw2-pr37-vhp5
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-648
Updated
2026-11-02
NVD 7.8

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-648
Updated
2026-11-02
OSVALPINE-CVE-2019-10216 7.8

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
ALPINE-CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-10216 7.8

CVE-2019-10216 does not affect BellSoft software

Record
BELL-CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSV 7.8

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-10216 7.8

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
DEBIAN-CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2462 7.3

Red Hat Security Advisory: ghostscript security update

Record
RHSA-2019:2462
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2019:2465 7.3

Red Hat Security Advisory: ghostscript security update

Record
RHSA-2019:2465
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10216 7.8

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Record
UBUNTU-CVE-2019-10216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVMGASA-2019-0236 No score

Updated ghostscript packages fix security vulnerability

Updated ghostscript packages fix security vulnerability:

It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas (CVE-2019-10216).

Also, the Mageia 7 update fixes a bounding box issue that affects klatexformula (mga#24866).

Record
MGASA-2019-0236
Updated
2026-11-02
OSVopenSUSE-SU-2019:2139-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Security issue fixed:

  • CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2139-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2160-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Security issue fixed:

  • CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2160-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10783-1 No score

ghostscript-9.54.0-2.2 on GA media

These are all security issues fixed in the ghostscript-9.54.0-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10783-1
Updated
2026-11-02
OSVSUSE-SU-2019:2347-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Security issue fixed:

  • CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).
Record
SUSE-SU-2019:2347-1
Updated
2026-11-02
OSVSUSE-SU-2019:2348-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Security issue fixed:

  • CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).
Record
SUSE-SU-2019:2348-1
Updated
2026-11-02
OSVUSN-4092-1 No score

ghostscript vulnerability

Netanel Fisher discovered that the font handler in Ghostscript did not properly restrict privileged calls when '-dSAFER' restrictions were in effect. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files.

Record
USN-4092-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Alpine:v3.10
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.11
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.12
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.13
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.14
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.15
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.16
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.17
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.18
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.19
before 9.27-r2
9.27-r2
Show 74 moreShow less
Affected packages
PackageAffectedFixed
ghostscript
Alpine:v3.20
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.21
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.22
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.23
before 9.27-r2
9.27-r2
ghostscript
Alpine:v3.7
before 9.26-r3
9.26-r3
ghostscript
Alpine:v3.8
before 9.26-r3
9.26-r3
ghostscript
Alpine:v3.9
before 9.26-r3
9.26-r3
ghostscript
Debian:12
before 9.27~dfsg-3.1
9.27~dfsg-3.1
ghostscript
Debian:13
before 9.27~dfsg-3.1
9.27~dfsg-3.1
ghostscript
Debian:14
before 9.27~dfsg-3.1
9.27~dfsg-3.1
ghostscript
Debian:8
before 9.26a~dfsg-0+deb8u4, plus listed versions
9.06~dfsg-29.06~dfsg-2+deb8u19.06~dfsg-2+deb8u109.06~dfsg-2+deb8u119.06~dfsg-2+deb8u12
Show 45 moreShow less
9.06~dfsg-2+deb8u139.06~dfsg-2+deb8u29.06~dfsg-2+deb8u39.06~dfsg-2+deb8u49.06~dfsg-2+deb8u59.06~dfsg-2+deb8u69.06~dfsg-2+deb8u79.06~dfsg-2+deb8u89.06~dfsg-2+deb8u99.10~dfsg-19.15~dfsg-19.15~rc1~dfsg-19.16~dfsg-19.16~dfsg-29.16~dfsg-2+sparc649.16~dfsg-2.19.16~dfsg-2.1+sparc649.18~dfsg-19.18~dfsg-29.18~dfsg-39.18~dfsg-49.19~dfsg-19.19~dfsg-29.19~dfsg-39.19~dfsg-3.19.19~~rc1~dfsg-19.20~dfsg-19.20~dfsg-1~exp19.20~dfsg-29.20~dfsg-39.20~dfsg-3.19.20~dfsg-3.29.21~dfsg-19.21~dfsg-1~exp19.22~dfsg-19.22~dfsg-29.22~dfsg-2.19.22~dfsg-2~riscv649.22~dfsg-39.22~~rc1~dfsg-19.24~~rc2~dfsg-19.25~dfsg-19.25~dfsg-1~exp19.25~dfsg-29.25~dfsg-3
9.26a~dfsg-0+deb8u4
ghostscript
Debian:9
before 9.26a~dfsg-0+deb9u4, plus listed versions
9.20~dfsg-3.29.20~dfsg-3.2+deb9u19.20~dfsg-3.2+deb9u29.20~dfsg-3.2+deb9u39.20~dfsg-3.2+deb9u4
Show 26 moreShow less
9.20~dfsg-3.2+deb9u59.21~dfsg-19.21~dfsg-1~exp19.22~dfsg-19.22~dfsg-29.22~dfsg-2.19.22~dfsg-2~riscv649.22~dfsg-39.22~~rc1~dfsg-19.24~~rc2~dfsg-19.25~dfsg-0+deb9u19.25~dfsg-19.25~dfsg-1~exp19.25~dfsg-29.25~dfsg-39.25~dfsg-49.25~dfsg-59.25~dfsg-69.25~dfsg-79.26a~dfsg-0+deb9u19.26a~dfsg-0+deb9u29.26a~dfsg-0+deb9u39.26~dfsg-0+deb9u19.26~dfsg-0+deb9u29.26~dfsg-19.26~dfsg-2
9.26a~dfsg-0+deb9u4
ghostscript
Debian:10
before 9.27~dfsg-2+deb10u1, plus listed versions
9.27~dfsg-2
9.27~dfsg-2+deb10u1
ghostscript
Mageia:6
before 9.26-1.5.mga6
9.26-1.5.mga6
ghostscript
Mageia:7
before 9.27-1.2.mga7
9.27-1.2.mga7
ghostscript
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-cups
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-debuginfo
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-doc
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-gtk
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs-devel
Red Hat:enterprise_linux:7::client
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-cups
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-debuginfo
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-doc
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-gtk
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs-devel
Red Hat:enterprise_linux:7::computenode
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-cups
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-debuginfo
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-doc
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-gtk
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs-devel
Red Hat:enterprise_linux:7::server
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-cups
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-debuginfo
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-doc
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript-gtk
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
libgs-devel
Red Hat:enterprise_linux:7::workstation
before 0:9.25-2.el7_7.1
0:9.25-2.el7_7.1
ghostscript
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-debugsource
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-gtk-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-x11-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
libgs
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
libgs-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-debuginfo
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-debugsource
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-doc
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-gtk-debuginfo
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-tools-dvipdf
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-tools-fonts
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-tools-printing
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-x11
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript-x11-debuginfo
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
libgs-debuginfo
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
libgs-devel
Red Hat:enterprise_linux:8::crb
before 0:9.25-2.el8_0.2
0:9.25-2.el8_0.2
ghostscript
SUSE:Linux Enterprise Desktop 12 SP4
before 9.26a-23.25.1
9.26a-23.25.1
ghostscript
SUSE:Linux Enterprise Software Development Kit 12 SP4
before 9.26a-23.25.1
9.26a-23.25.1
ghostscript
SUSE:Linux Enterprise Server 12 SP4
before 9.26a-23.25.1
9.26a-23.25.1
ghostscript
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
before 9.26a-23.25.1
9.26a-23.25.1
ghostscript
SUSE:Linux Enterprise Module for Basesystem 15
before 9.26a-3.18.2
9.26a-3.18.2
ghostscript
SUSE:Linux Enterprise Module for Basesystem 15 SP1
before 9.26a-3.18.2
9.26a-3.18.2
ghostscript
Ubuntu:16.04:LTS
before 9.26~dfsg+0-0ubuntu0.16.04.10, plus listed versions
9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2
Show 17 moreShow less
9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.9
9.26~dfsg+0-0ubuntu0.16.04.10
ghostscript
Ubuntu:18.04:LTS
before 9.26~dfsg+0-0ubuntu0.18.04.10, plus listed versions
9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1
Show 9 moreShow less
9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.9
9.26~dfsg+0-0ubuntu0.18.04.10
ghostscript
openSUSE:Leap 15.1
before 9.26a-lp151.3.3.1
9.26a-lp151.3.3.1
ghostscript-mini
openSUSE:Leap 15.1
before 9.26a-lp151.3.3.1
9.26a-lp151.3.3.1
ghostscript
openSUSE:Leap 15.0
before 9.26a-lp150.2.20.1
9.26a-lp150.2.20.1
ghostscript-mini
openSUSE:Leap 15.0
before 9.26a-lp150.2.20.1
9.26a-lp150.2.20.1
ghostscript
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
before 9.54.0-2.2
9.54.0-2.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10216 is a high vulnerability (CVSS 7.3) in Artifex Ghostscript, published August 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.30%, the 83rd percentile. Fixed in ghostscript 9.27-r2.

References

Show 66 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

MoveEnter Open