{"id":"CVE-2019-25059","aliases":["BELL-CVE-2019-25059","DEBIAN-CVE-2019-25059","DLA-2989-1","EUVD-2019-11506","GHSA-77gr-wgqv-qjfm","UBUNTU-CVE-2019-25059","USN-5396-1","USN-5396-2"],"status":"published","title":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an...","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01165,"percentile":0.67718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-25T03:29:14Z","modified":"2026-09-21T07:02:55Z","fixes":[{"ecosystem":"Debian:12","package":"ghostscript","fixed_in":["9.27~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["9.27~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["9.27~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ghostscript","fixed_in":["9.26a~dfsg-0+deb9u9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.16.04.14+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26a~dfsg-0+deb9u9"}]}],"versions":["9.20~dfsg-3.2","9.20~dfsg-3.2+deb9u1","9.20~dfsg-3.2+deb9u2","9.20~dfsg-3.2+deb9u3","9.20~dfsg-3.2+deb9u4","9.20~dfsg-3.2+deb9u5","9.21~dfsg-1","9.21~dfsg-1~exp1","9.22~dfsg-1","9.22~dfsg-2","9.22~dfsg-2.1","9.22~dfsg-2~riscv64","9.22~dfsg-3","9.22~~rc1~dfsg-1","9.24~~rc2~dfsg-1","9.25~dfsg-0+deb9u1","9.25~dfsg-1","9.25~dfsg-1~exp1","9.25~dfsg-2","9.25~dfsg-3","9.25~dfsg-4","9.25~dfsg-5","9.25~dfsg-6","9.25~dfsg-7","9.26a~dfsg-0+deb9u1","9.26a~dfsg-0+deb9u2","9.26a~dfsg-0+deb9u3","9.26a~dfsg-0+deb9u4","9.26a~dfsg-0+deb9u5","9.26a~dfsg-0+deb9u6","9.26a~dfsg-0+deb9u7","9.26a~dfsg-0+deb9u8","9.26~dfsg-0+deb9u1","9.26~dfsg-0+deb9u2","9.26~dfsg-1","9.26~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm3"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.16"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.16"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm3"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2"]}],"products":[{"vendor":"artifex","product":"ghostscript"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=430e219ea17a2650577d70021399c4ead05869e0","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25059"},{"url":"http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=430e219ea17a2650577d70021399c4ead05869e0"},{"url":"https://github.com/advisories/GHSA-77gr-wgqv-qjfm"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-25059","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25059","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25059","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5396-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5396-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25059","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-25059","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T03:29:14Z","modified":"2024-08-05T03:00:19.064Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-11506","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T03:29:14Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-77gr-wgqv-qjfm","title":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an...","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-26T00:00:43Z","modified":"2023-01-27T05:02:03Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:42:00.879238Z"}],"nvd":[{"id":"CVE-2019-25059","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T04:15:07.8Z","modified":"2026-06-17T02:31:34.52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:49.099942Z"}],"osv":[{"id":"BELL-CVE-2019-25059","title":"CVE-2019-25059 does not affect BellSoft software","status":"withdrawn","published":"2022-04-25T04:15:00Z","modified":"2026-01-26T09:48:23.508591Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-25059","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T04:15:07.8Z","modified":"2026-03-14T09:37:03.77839Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-25059","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T04:15:07.8Z","modified":"2026-09-21T07:02:55.375605413Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-25059","description":"Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.","status":"published","published":"2022-04-25T04:15:00Z","modified":"2026-04-22T12:17:58.373766Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2989-1","title":"ghostscript - security update","status":"published","published":"2022-05-01T00:00:00Z","modified":"2026-03-09T01:22:09.517993Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5396-1","title":"ghostscript vulnerability","description":"It was discovered that Ghostscript incorrectly handled certain PostScript\nfiles. If a user or automated system were tricked into processing a\nspecially crafted file, a remote attacker could possibly use this issue to\naccess arbitrary files, execute arbitrary code, or cause a denial of\nservice.\n","status":"published","published":"2022-04-28T17:04:08Z","modified":"2026-04-22T10:23:26.480932Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5396-2","title":"ghostscript vulnerability","description":"USN-5396-1 addressed a vulnerability in Ghostscript. This update\nprovides the corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Ghostscript incorrectly handled certain PostScript\n files. If a user or automated system were tricked into processing a\n specially crafted file, a remote attacker could possibly use this issue to\n access arbitrary files, execute arbitrary code, or cause a denial of\n service.\n","status":"published","published":"2022-06-08T19:56:32Z","modified":"2026-06-25T13:31:09.174171932Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}