REDHAT-BUG-1446063: High severity Artifex ghostscript vulnerability

Q: Does running Ghostscript with the -dSAFER option prevent exploitation?

No. The reported issue is a bypass of -dSAFER, allowing command execution through a crafted EPS input containing a /OutputFile (%pipe% substring.

Q: Which systems are exposed to this issue?

Systems are exposed when the gs program processes attacker-controlled or otherwise untrusted EPS documents. An attacker needs to provide a crafted EPS document as input to Ghostscript.

Published Apr 27, 2017

Updated

It was reported that Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program.

Upstream issue:

https://bugs.ghostscript.com/showbug.cgi?id=697808

Affected Software

1 affected component

Artifex ghostscript<=2017-04-26

Event History

Apr 27, 2017

Data Sourced

via Red Hat·08:03 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does running Ghostscript with the -dSAFER option prevent exploitation?

No. The reported issue is a bypass of -dSAFER, allowing command execution through a crafted EPS input containing a /OutputFile (%pipe% substring.

Which systems are exposed to this issue?

Systems are exposed when the gs program processes attacker-controlled or otherwise untrusted EPS documents. An attacker needs to provide a crafted EPS document as input to Ghostscript.

REDHAT-BUG-1446063: High severity Artifex ghostscript vulnerability

Affected Software

Event History

Frequently Asked Questions

Does running Ghostscript with the -dSAFER option prevent exploitation?

Which systems are exposed to this issue?

Company

Resources

Contact

Frequently Asked Questions

Does running Ghostscript with the -dSAFER option prevent exploitation?

Which systems are exposed to this issue?