CVE-2017-8291

Artifex Ghostscript Type Confusion

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 97.0%

Published26 Apr 2017
Added to CISA KEV24 May 2022
Remediation due14 Jun 2022

Description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Artifex Ghostscript< 9.21

Debian Linux8.0

Redhat Enterprise Linux Desktop6.0 · 7.0

Redhat Enterprise Linux Eus7.3 · 7.4 · 7.5 · 7.6

Redhat Enterprise Linux Server6.0 · 7.0

Redhat Enterprise Linux Server Aus7.3 · 7.4 · 7.6 · 7.7

Redhat Enterprise Linux Server Tus7.3 · 7.6 · 7.7

Redhat Enterprise Linux Workstation6.0 · 7.0

Remediation

Fixed in

Artifex Ghostscript≥ 9.21

Patch & vendor advisories

References

http://openwall.com/lists/oss-security/2017/04/28/2Mailing ListPatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:1230Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=697808Issue TrackingThird Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1446063Issue TrackingPatchThird Party AdvisoryVDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1036453ExploitIssue TrackingThird Party AdvisoryVDB Entry
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47dBroken Link
https://security.gentoo.org/glsa/201708-06Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291US Government Resource
https://www.exploit-db.com/exploits/41955/ExploitThird Party AdvisoryVDB Entry
http://www.debian.org/security/2017/dsa-3838Mailing ListThird Party Advisory

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2017-8291 being actively exploited?

Yes. CVE-2017-8291 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 May 2022.

How severe is CVE-2017-8291?

CVE-2017-8291 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 97.0% probability of exploitation.

Which products are affected by CVE-2017-8291?

Affected products include Artifex Ghostscript, Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, and 3 more.

How do I fix CVE-2017-8291?

Upgrade affected software to a fixed version, for example Artifex Ghostscript 9.21 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-8291 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.