CVE-2021-3781

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2002271 Issue Tracking Patch Third Party Advisory
https://ghostscript.com/CVE-2021-3781.html Patch Vendor Advisory
https://security.gentoo.org/glsa/202211-11 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.53.3:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.54.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

History

26 Jun 2023, 18:56

Type Values Removed Values Added
CWE CWE-20 CWE-78

31 Jan 2023, 17:29

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202211-11 - (GENTOO) https://security.gentoo.org/glsa/202211-11 - Third Party Advisory

22 Nov 2022, 06:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202211-11 -

28 Feb 2022, 19:52

Type Values Removed Values Added
CPE cpe:2.3:a:artifex:ghostscript:9.53.3:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.54.0:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2002271 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2002271 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://ghostscript.com/CVE-2021-3781.html - (MISC) https://ghostscript.com/CVE-2021-3781.html - Patch, Vendor Advisory
First Time Artifex ghostscript
Artifex
Fedoraproject fedora
Fedoraproject
CVSS v2 : unknown
v3 : unknown
v2 : 9.3
v3 : 9.9
CWE CWE-20

16 Feb 2022, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-02-16 19:15

Updated : 2023-12-10 14:22


NVD link : CVE-2021-3781

Mitre link : CVE-2021-3781

CVE.ORG link : CVE-2021-3781


JSON object : View

Products Affected

fedoraproject

  • fedora

artifex

  • ghostscript
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-20

Improper Input Validation