CVE-2021-3781
CVE-2021-3781
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS 9.9 · Critical · EPSS 83.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
ghostscript
- Versions
- ghostpdl 9.55.0: Affected
No fix published
ghostscript Debian:12
- Affected ranges
- ECOSYSTEM: < 9.53.3~dfsg-8
Update to 9.53.3~dfsg-8
ghostscript Debian:13
- Affected ranges
- ECOSYSTEM: < 9.53.3~dfsg-8
Update to 9.53.3~dfsg-8
ghostscript Debian:14
- Affected ranges
- ECOSYSTEM: < 9.53.3~dfsg-8
Update to 9.53.3~dfsg-8
ghostscript Ubuntu:20.04:LTS
- Versions
- 9.27~dfsg+0-0ubuntu3
- 9.27~dfsg+0-0ubuntu4
- 9.50~dfsg-5ubuntu1
- 9.50~dfsg-5ubuntu2
- 9.50~dfsg-5ubuntu3
- 9.50~dfsg-5ubuntu4
- 9.50~dfsg-5ubuntu4.1
- 9.50~dfsg-5ubuntu4.2
- Affected ranges
- ECOSYSTEM: < 9.50~dfsg-5ubuntu4.3
Update to 9.50~dfsg-5ubuntu4.3
ghostscript Ubuntu:22.04:LTS
- Affected ranges
- ECOSYSTEM: < 9.54.0~dfsg1-0ubuntu2
Update to 9.54.0~dfsg1-0ubuntu2