Artifex Ghostscript Type Confusion Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-24
• EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CISA: Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 14 Jun 2022): Apply updates per vendor instructions.

• Patch on openwall.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on bugzilla.redhat.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• openwall.com/lists/oss-security/2017/04/28/2Mailing ListPatchThird Party Advisory
• www.debian.org/security/2017/dsa-3838Mailing ListThird Party Advisory
• www.securityfocus.com/bid/98476Broken LinkThird Party AdvisoryVDB Entry
• access.redhat.com/errata/RHSA-2017:1230Third Party Advisory
• bugs.ghostscript.com/show_bug.cgiIssue TrackingThird Party AdvisoryVDB Entry
• bugzilla.redhat.com/show_bug.cgiIssue TrackingPatchThird Party Advisory
• bugzilla.suse.com/show_bug.cgiExploitIssue TrackingThird Party Advisory
• git.ghostscript.comBroken Link
• security.gentoo.org/glsa/201708-06Third Party Advisory
• www.exploit-db.com/exploits/41955ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource