Description
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.debian.org/security/2017/dsa-3838 ↗
- https://bugzilla.suse.com/show_bug.cgi?id=1036453 ↗
- https://access.redhat.com/errata/RHSA-2017:1230 ↗
- http://www.securityfocus.com/bid/98476 ↗
- https://www.exploit-db.com/exploits/41955/ ↗
- http://openwall.com/lists/oss-security/2017/04/28/2 ↗
- https://security.gentoo.org/glsa/201708-06 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1446063 ↗
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d ↗
- https://bugs.ghostscript.com/show_bug.cgi?id=697808 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291 ↗