CVE-2021-3781

NameCVE-2021-3781
DescriptionA trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4972-1
Debian Bugs994011

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ghostscript (PTS)jessie, jessie (lts)9.26a~dfsg-0+deb8u13fixed
stretch (security)9.26a~dfsg-0+deb9u9fixed
stretch (lts), stretch9.26a~dfsg-0+deb9u13fixed
buster, buster (lts)9.27~dfsg-2+deb10u10fixed
buster (security)9.27~dfsg-2+deb10u9fixed
bullseye9.53.3~dfsg-7+deb11u7fixed
bullseye (security)9.53.3~dfsg-7+deb11u9fixed
bookworm10.0.0~dfsg-11+deb12u5fixed
bookworm (security)10.0.0~dfsg-11+deb12u6fixed
sid, trixie10.04.0~dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ghostscriptsourcejessie(not affected)
ghostscriptsourcestretch(not affected)
ghostscriptsourcebuster(not affected)
ghostscriptsourcebullseye9.53.3~dfsg-7+deb11u1DSA-4972-1
ghostscriptsource(unstable)9.53.3~dfsg-8994011

Notes

[buster] - ghostscript <not-affected> (Vulnerable code introduced later)
[stretch] - ghostscript <not-affected> (Vulnerable code introduced later)
https://twitter.com/ducnt_/status/1434534373416574983
https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50
https://bugs.ghostscript.com/show_bug.cgi?id=704342
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a9bd3dec9fde03327a4a2c69dad1036bf9632e20
[jessie] - ghostscript <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems