Improper Use of Validation Framework Affecting ghostscript-tools-dvipdf package, versions *
Threat Intelligence
EPSS
0.07% (32nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-GHOSTSCRIPTTOOLSDVIPDF-2803448
- published 26 Apr 2022
- disclosed 25 Apr 2022
Introduced: 25 Apr 2022
CVE-2019-25059 Open this link in a new tabHow to fix?
There is no fixed version for RHEL:8 ghostscript-tools-dvipdf.
NVD Description
Note: Versions mentioned in the description apply only to the upstream ghostscript-tools-dvipdf package and not the ghostscript-tools-dvipdf package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.
References
- https://access.redhat.com/security/cve/CVE-2019-25059
- http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=430e219ea17a2650577d70021399c4ead05869e0
- https://lists.debian.org/debian-lts-announce/2022/05/msg00000.html
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=430e219ea17a2650577d70021399c4ead05869e0
CVSS Scores
version 3.1