CVE-2021-3781: artifex ghostscript +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-3781

CVSS 9.9 · Critical EPSS 83,9%

Kerentanan Improper Input Validation pada artifex ghostscript, fedoraproject fedora. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Rincian

Terbit di NVD: 16 Februari 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 83,9% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
artifex	ghostscript	Versi 9.50
artifex	ghostscript	Versi 9.52
artifex	ghostscript	Versi 9.53.3
artifex	ghostscript	Versi 9.54.0
fedoraproject	fedora	Versi 34

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://ghostscript.com/CVE-2021-3781.html patch · advisory vendor
https://bugzilla.redhat.com/show_bug.cgi?id=2002271 issue tracking · patch · advisory pihak ketiga
https://security.gentoo.org/glsa/202211-11 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.