⚠ Actively exploited
Added to CISA KEV on 2022-05-24. Federal agencies required to patch by 2022-06-14. Required action: Apply updates per vendor instructions..

CVE-2017-8291 — Type Confusion in Ghostscript

CWE-843 — Type ConfusionCWE-704 — Incorrect Type Conversion or CastCWE-77 — Command Injection18 documents14 sources
Severity
7.8HIGHNVD
OSV5.5
EPSS
92.9%
top 0.23%
CISA KEV
KEV
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
8
Artifex GhostscriptDebian LinuxRedhat Enterprise Linux Desktop+5 more
Timeline
PublishedApr 27
KEV addedMay 24
KEV dueJun 14
CISA Required Action: Apply updates per vendor instructions.

Description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶Debianartifex/ghostscript< 9.20~dfsg-3.1+3
▶Ubuntuartifex/ghostscript< 9.10~dfsg-0ubuntu10.7+1

Also affects: Debian Linux 8.0, Enterprise Linux 7.3, 7.4, 7.5, 7.6, 7.7

Patches

Patch: openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

6
GHSA
GHSA-rh88-cwv2-gjxm: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via↗2022-05-14
▶
OSV
ghostscript regression↗2017-05-16
▶
OSV
ghostscript vulnerabilities↗2017-04-28
▶
OSV
CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via↗2017-04-27
▶
CVEList
CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via↗2017-04-27
▶

💥Exploits & PoCs

1
Exploit-DB
Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit)↗2017-05-02
▶

📋Vendor Advisories

4
CISA
Artifex Ghostscript Type Confusion Vulnerability↗2022-05-24
▶
Ubuntu
Ghostscript vulnerabilities↗2017-04-28
▶
Red Hat
ghostscript: corruption of operand stack↗2017-04-26
▶
Debian
CVE-2017-8291: ghostscript - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command ...↗2017
▶

📄Research Papers

1
CTF
pillow / README↗2017
▶

💬Community

3
HackerOne
Remote code execution on Basecamp.com↗2020-11-26
▶
Bugzilla
CVE-2017-8291 ghostscript: corruption of operand stack↗2017-04-27
▶
Bugzilla
CVE-2017-8291 ghostscript: -dSAFER bypass and command execution via a "/OutputFile (%pipe%" substring [fedora-all]↗2017-04-27
▶
CVE-2017-8291 — Type Confusion in Artifex Ghostscript | cvebase