CVE-2017-8291highunder attackCWE-843

CVE-2017-8291

Published · Updated

Follow this CVE+ Monitor Ghostscript+ Monitor ghostscript

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 97%
from disclosure to weapon5 days
Published on NVDApr 27
1st PoC+5d
metasploitApr 27
CISA KEV+1853d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
no_fix_planned: Will not fix
Fixed
16 products (504 components)
Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · and others 11
fix ↗
Under investigation
1 product
Red Hat OpenShift Enterprise 2
Action required by CISAfederal deadline: 2022-06-14

Apply updates per vendor instructions.

In short

Ghostscript had a security bypass that allowed attackers to execute commands on a computer by tricking the program with a specially crafted document. Even when security protections were turned on, a malicious file could still run dangerous code.

Technical detail

A type confusion vulnerability in Ghostscript's parameter handling allowed attackers to bypass the -dSAFER sandbox restriction through crafted .eps files containing /OutputFile (%pipe% directives. This enabled arbitrary command execution with the privileges of the gs process, exploitable via remote document processing.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.