CVE-2021-3781

high-risk
Published 2022-02-16

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Do I need to act?

~
7.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Fedoraproject Artifex

References (6)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2002271
Patch https://ghostscript.com/CVE-2021-3781.html
Third Party Advisory https://security.gentoo.org/glsa/202211-11
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2002271
Patch https://ghostscript.com/CVE-2021-3781.html
Third Party Advisory https://security.gentoo.org/glsa/202211-11
55
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 10/34 · Low
Exposure 12/34 · Low