CVE-2017-8291

Ghostscript versions through 2017-04-26 contain a type confusion flaw (CWE-843) in the .rsdparams routine that also permits bypass of the -dSAFER security sandbox. The flaw is triggered when the gs program processes a crafted .eps (PostScript) document containing a "/OutputFile (%pipe%" substring, which causes Ghostscript to execute embedded operating system commands. An attacker gains command execution with the privileges of the gs process, which commonly runs in document-conversion pipelines, print servers, and image-processing tools such as ImageMagick. Users of upstream Ghostscript and distributions that ship it, notably Debian and Red Hat Enterprise Linux desktop, server, and workstation variants, are affected. The flaw was exploited in the wild in April 2017, was added to the CISA Known Exploited Vulnerabilities catalog on 2022-05-24, and carries a 97% EPSS probability of exploitation.

What to do: Apply the Ghostscript fixes released after 2017-04-26 per your distribution's security advisories (Debian, Red Hat) and upstream Artifex updates, as required by CISA's KEV listing. As interim mitigation, avoid processing untrusted EPS/PostScript files with gs, including indirect processing via ImageMagick/convert pipelines and print servers, since the %pipe% OutputFile trick executes shell commands. Inventory systems that run Ghostscript for server-side document or image conversion, as those face the greatest exposure.