What’s Vulnerable › Vulnerabilities

CVE-2017-8291: Artifex Ghostscript Type Confusion Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-05-24
• EPSS: 97.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-27 · updated 2026-06-17
• Weakness: CWE-843

Description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

Affected products

• Artifex Ghostscript: before 9.21 — fixed in 9.21
• Debian Linux: 8.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Eus: 7.3, 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.3, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 6.0, 7.0

How to fix

Upgrade to a fixed version: Artifex Ghostscript 9.21. Check the vendor advisory for mitigations.

References

• http://openwall.com/lists/oss-security/2017/04/28/2
• http://www.debian.org/security/2017/dsa-3838
• http://www.securityfocus.com/bid/98476
• https://access.redhat.com/errata/RHSA-2017:1230
• https://bugs.ghostscript.com/show_bug.cgi?id=697808
• https://bugzilla.redhat.com/show_bug.cgi?id=1446063
• https://bugzilla.suse.com/show_bug.cgi?id=1036453
• https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d
• https://security.gentoo.org/glsa/201708-06
• https://www.exploit-db.com/exploits/41955/
• http://openwall.com/lists/oss-security/2017/04/28/2
• http://www.debian.org/security/2017/dsa-3838

Get alerted when CVE-2017-8291 or the next vulnerability affects your stack