CVE-2021-3781

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2002271 Issue Tracking Patch Third Party Advisory
https://ghostscript.com/CVE-2021-3781.html Patch Vendor Advisory
https://security.gentoo.org/glsa/202211-11 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.53.3:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.54.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

History

31 Jan 2023, 17:29

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202211-11 - (GENTOO) https://security.gentoo.org/glsa/202211-11 - Third Party Advisory

22 Nov 2022, 06:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202211-11 -

28 Feb 2022, 19:52

Type Values Removed Values Added
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2002271 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2002271 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://ghostscript.com/CVE-2021-3781.html - (MISC) https://ghostscript.com/CVE-2021-3781.html - Patch, Vendor Advisory
First Time Artifex ghostscript
Artifex
Fedoraproject fedora
Fedoraproject
CWE CWE-20
CVSS v2 : unknown
v3 : unknown
v2 : 9.3
v3 : 9.9
CPE cpe:2.3:a:artifex:ghostscript:9.53.3:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.54.0:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

16 Feb 2022, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-02-16 19:15

Updated : 2023-01-31 17:29


NVD link : CVE-2021-3781

Mitre link : CVE-2021-3781


JSON object : View

Products Affected

artifex

  • ghostscript

fedoraproject

  • fedora
CWE
CWE-20

Improper Input Validation