CVE-2017-5951: Denial of Service in Ghostscript
Summary
CVE-2017-5951: The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Affects ghostscript versions < 9.21-r3. Fixed in 9.21-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. However, a vulnerability in Ghostscript version 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by exploiting a flaw in the mem_get_bits_rectangle function in the base/gdevmem.c file.
Vulnerability Detail
The vulnerability (CVE-2017-5951) originates from an issue in the mem_get_bits_rectangle function of Ghostscript. By sending a specially crafted file, an attacker can trigger a NULL pointer dereference, leading to a crash of the application. This vulnerability can be exploited remotely, potentially causing disruption to the affected system. The severity of this vulnerability is rated as moderate, with a CVSS score of 5.5.
How To Fix
Minimum fixed version
9.21-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Ghostscript to mitigate the risk of exploitation.
Conclusion
The vulnerability (CVE-2017-5951) in Ghostscript can lead to a denial of service due to a NULL pointer dereference issue. It is recommended to update to Ghostscript version 9.21-r3 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference issue in Ghostscript. This can result in the application crashing and potential disruption to the affected system.
To fix this vulnerability, update Ghostscript to version 9.21-r3 or later. This update includes a patch that addresses the NULL pointer dereference issue.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of Ghostscript.
The severity of this vulnerability is rated as moderate, with a CVSS score of 5.5.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
