Denial of Service Vulnerability in Ghostscript Package
Summary
ALPINE-CVE-2017-5951: The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Affects ghostscript versions < 9.21-r3. Fixed in 9.21-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. Ghostscript is known for its ability to convert documents into different formats, making it a crucial tool for developers and users who work with print and document management. However, it has been identified to have a vulnerability that can lead to a denial of service, affecting its reliability and performance.
Vulnerability Detail
The vulnerability identified as CVE-2017-5951 in Ghostscript version 9.20 allows remote attackers to exploit the mem_get_bits_rectangle function in base/gdevmem.c. This exploitation can lead to a denial of service through a NULL pointer dereference, causing the application to crash. The vulnerability arises from improper handling of crafted files, which can be used by attackers to disrupt service and impact users relying on Ghostscript for document processing.
How To Fix
Minimum fixed version
9.21-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users are advised to avoid processing untrusted or crafted files that may exploit this vulnerability until the package is updated. Implementing strict file validation can also help mitigate the risk.
Conclusion
The vulnerability CVE-2017-5951 in Ghostscript poses a significant risk of denial of service due to improper handling of crafted files. It is crucial for users to update to the patched version 9.21-r3 to mitigate this risk. Until then, implementing workarounds such as avoiding untrusted files can help protect against potential exploitation.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2017-5951 is a vulnerability in Ghostscript that allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
If immediate updating is not possible, avoid processing untrusted files and implement strict file validation as a temporary measure.
You can find more information about vulnerabilities in Ghostscript on the official Ghostscript website or security databases like CVE.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
