Log in Start free

Actively exploited · Published Apr 27, 2017 · Assigned by mitre

CVE-2017-8291

High 7.8 Exploited

In plain English

A high-severity type confusion in Ghostscript from Artifex. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). The chance it is exploited in the next 30 days is estimated at 97.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)97.0%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since May 24, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 14, 2022.

Official description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20ghostscript9.21-r2ALPINE-CVE-2017-8291
Alpine:v3.21ghostscript9.21-r2ALPINE-CVE-2017-8291
Alpine:v3.22ghostscript9.21-r2ALPINE-CVE-2017-8291
Alpine:v3.23ghostscript9.21-r2ALPINE-CVE-2017-8291
Alpine:v3.24ghostscript9.21-r2ALPINE-CVE-2017-8291
Debian:12ghostscript9.20~dfsg-3.1DEBIAN-CVE-2017-8291
Debian:13ghostscript9.20~dfsg-3.1DEBIAN-CVE-2017-8291
Debian:14ghostscript9.20~dfsg-3.1DEBIAN-CVE-2017-8291

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-843 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References