Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16288: A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. However, version 9.50 of GhostScript is vulnerable to a buffer overflow issue in the pj_common_print_page() function of the devices/gdevpjet.c file. This vulnerability can be exploited by a remote attacker through a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript v9.50, identified as CVE-2020-16288, allows an attacker to cause a denial of service (DoS) by exploiting the pj_common_print_page() function. By sending a specially crafted PDF file, the attacker can trigger the buffer overflow, leading to a crash or potential execution of arbitrary code. This vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker through a crafted PDF file, leading to a denial of service (DoS) condition or potential execution of arbitrary code. It is crucial to update to GhostScript version 9.51 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability can result in a denial of service (DoS) condition, potentially crashing the GhostScript interpreter or allowing the execution of arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your version of GhostScript is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground and it will alert you if the vulnerability is present.
Yes, a patch is available in GhostScript version 9.51. It is recommended to update to this version or later to fix the vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can find more information about this vulnerability in the CVE-2020-16288 JSON report at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-16288.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
