Bug 1446063 (CVE-2017-8291) - CVE-2017-8291 ghostscript: corruption of operand stack
Summary: CVE-2017-8291 ghostscript: corruption of operand stack
Alias: CVE-2017-8291
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
: 1445359 (view as bug list)
Depends On: 1446064 1447220 1447221 1447222 1447223
Blocks: 1445360 1446066
TreeView+ depends on / blocked
Reported: 2017-04-27 08:03 UTC by Adam Mariš
Modified: 2021-12-10 15:01 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection.
Clone Of:
Last Closed: 2017-05-12 11:51:35 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1230 0 normal SHIPPED_LIVE Important: ghostscript security update 2017-05-12 14:19:52 UTC

Description Adam Mariš 2017-04-27 08:03:21 UTC
It was reported that Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program.

Upstream issue:


Comment 1 Adam Mariš 2017-04-27 08:03:53 UTC
Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1446064]

Comment 3 Cedric Buissart 2017-04-28 12:46:45 UTC
This is a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1445359

Comment 4 Cedric Buissart 2017-04-28 14:51:43 UTC
*** Bug 1445359 has been marked as a duplicate of this bug. ***

Comment 9 Cedric Buissart 2017-05-03 14:56:20 UTC
The original patch has a regression in some rare conditions (when using the "DELAYBIND" feature). In such situation, the additional patch is required :

Comment 10 Cedric Buissart 2017-05-11 13:21:34 UTC
It appears that the additional patch in comment 9 has its own regression.

Comment 11 Cedric Buissart 2017-05-11 13:52:43 UTC
One more patch :
* Bug 697892: fix check for op stack underflow.

Comment 12 errata-xmlrpc 2017-05-12 10:20:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1230 https://access.redhat.com/errata/RHSA-2017:1230

Note You need to log in before you can comment on or make changes to this bug.