高危
Artifex Ghostscript类型混淆漏洞
2017-04-26 00:00:00 公开 ，2026-02-19 21:19:07 更新
- 关键漏洞
- CISA KEV
- 勒索软件漏洞
- APT漏洞
- 公开PoC
- 本地
- 无需认证
- 远程
- 开源组件漏洞
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-02-05 04:44:47
风险信息
- CVSS v2 向量
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- CVSS v2 风险值
- 6.8
- CVSS v3 向量
- AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 7.8
- CVSS v3.1 向量
- AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 7.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Artifex Ghostscript是美国Artifex Software公司的一款开源的PostScript（一种用于电子产业和桌面出版领域的页面描述语言和编程语言）解析器，它可显示Postscript文件以及在非Postscript打印机上打印Postscript文件。Artifex Ghostscript可能允许远程攻击者在系统上执行任意命令。通过使用带有/OutputFile的.rsdparams类型混淆，攻击者可以利用此漏洞绕过-dSAFER并在系统上执行任意命令。
- 修复建议
- 为该漏洞应用修补程序，可从Ghostscript GIT存储库获得： https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d
参考链接
- http://openwall.com/lists/oss-security/2017/04/28/2
OSV · x_refsource_MISC
- http://www.debian.org/security/2017/dsa-3838
OSV · vendor-advisory · x_refsource_DEBIAN
- https://access.redhat.com/errata/RHSA-2017:1230
OSV · vendor-advisory · x_refsource_REDHAT
- https://bugs.ghostscript.com/show_bug.cgi?id=697808
OSV · x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1446063
OSV · x_refsource_MISC
- https://bugzilla.suse.com/show_bug.cgi?id=1036453
OSV · x_refsource_MISC
- https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d
NVD
- https://security.gentoo.org/glsa/201708-06
OSV · vendor-advisory · x_refsource_GENTOO
- https://www.exploit-db.com/exploits/41955/
OSV · exploit · x_refsource_EXPLOIT-DB
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d
OSV · x_refsource_CONFIRM
- https://osv.dev/vulnerability/DLA-932-1
OSV
- http://www.securityfocus.com/bid/98476
OSV
- https://osv.dev/vulnerability/CVE-2017-8291
OSV
- https://osv.dev/vulnerability/DSA-3838-1
OSV
- https://security.alpinelinux.org/vuln/CVE-2017-8291
OSV
- https://security-tracker.debian.org/tracker/CVE-2017-8291
OSV
- https://ubuntu.com/security/CVE-2017-8291
OSV
- https://bugs.ghostscript.com/show_bug.cgi?id=697799
OSV
- http://www.openwall.com/lists/oss-security/2017/04/27/10
OSV
- https://ubuntu.com/security/notices/USN-3272-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2017-8291
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2017-8291
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2017-8291
OSV
- https://osv.dev/vulnerability/ALPINE-CVE-2017-8291
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291
NVD · US Government Resource