Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16290: A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability, identified as CVE-2020-16290, is a buffer overflow issue in the jetp3852_print_page() function of the devices/gdev3852.c file. This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in jetp3852_print_page() function of Artifex Software GhostScript v9.50 can be exploited by an attacker sending a specially crafted PDF file. When the vulnerable function processes the malicious file, it fails to properly validate the input, leading to a buffer overflow. This can result in a denial of service condition, causing the affected GhostScript instance to crash or become unresponsive. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be mitigated by updating to version 9.51 or later. It is important to promptly apply the fix to prevent potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file. This can result in the affected GhostScript instance crashing or becoming unresponsive.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your GhostScript version is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if your version is vulnerable.
No specific workarounds have been provided for this vulnerability. It is recommended to update to the fixed version of GhostScript.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is crucial to apply the recommended fix to prevent any potential attacks.
You can find more information about this vulnerability in the CVE-2020-16290 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-16290.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
