CVE-2017-7207: Denial of Service in Ghostscript
Summary
CVE-2017-7207: The mem_get_bits_rectangle function in Artifex Software, Inc. Affects ghostscript versions < 9.21-r3. Fixed in 9.21-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. However, a vulnerability in Ghostscript versions 9.20 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference) by exploiting a flaw in the mem_get_bits_rectangle function.
Vulnerability Detail
The mem_get_bits_rectangle function in Ghostscript can be exploited by a remote attacker through a crafted PostScript document. By leveraging this vulnerability, an attacker can trigger a NULL pointer dereference, leading to a denial of service condition. This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.21-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Ghostscript to the fixed version to mitigate the risk.
Conclusion
The vulnerability in Ghostscript allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference. To mitigate the risk, it is recommended to update Ghostscript to version 9.21-r3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference in Ghostscript. This can result in the affected system becoming unresponsive or crashing.
To fix this vulnerability, update Ghostscript to version 9.21-r3 or later. This update includes a patch that addresses the NULL pointer dereference issue.
No, there is no known workaround for this vulnerability. It is crucial to update Ghostscript to the fixed version.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
