Vulnerability Intelligence Report
CVE-2021-3781
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
No Active Exploit Signals
CVSS Base Score
9.9
CRITICAL
EPSS Probability:83.91%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗CWE-20
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| artifex | ghostscript | 9.50, 9.52, 9.53.3, 9.54.0 |
| fedoraproject | fedora | 34 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
83.913%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2021-09-09T00:00:00 |
| Published | 2022-02-16T00:00:00 |
| Last Updated | 2024-08-03T17:09:08 |
Community Chatter & Buzz