Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16289: A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF documents. GhostScript v9.50 is affected by a buffer overflow vulnerability in the cif_print_page() function, which is located in the devices/gdevcif.c file. This vulnerability can be exploited by a remote attacker through a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in cif_print_page() allows an attacker to cause a denial of service (DoS) by sending a specially crafted PDF file. By exploiting this vulnerability, an attacker can trigger the buffer overflow, leading to a crash or potential execution of arbitrary code. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update to the fixed version of Artifex Software GhostScript to mitigate the risk.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service or potentially execute arbitrary code. It is crucial to update to version 9.51 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF documents.
The vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted PDF file. It may also lead to the execution of arbitrary code.
To fix this vulnerability, update Artifex Software GhostScript to version 9.51 or later.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
