CVE-2019-3838
ghostscript: forceput in DefineResource is still accessible (700576)
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · March 21, 2019
Updated · November 22, 2025
Description
It was found that the forceput operator could be extracted from the DefineResource method. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
CVSS / CWE
CVSS 3.0 · 7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-648 · Incorrect Use of Privileged APIs