Buffer Overflow Vulnerability in GhostScript
Summary
CVE-2020-16292: A buffer overflow vulnerability in mj_raster_cmd() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability, identified as CVE-2020-16292, is a buffer overflow issue in the 'mj_raster_cmd()' function of the 'gdevmjc.c' file in the 'contrib/japanese' directory of GhostScript version 9.50. This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript version 9.50 arises from improper input validation in the 'mj_raster_cmd()' function. By providing a specially crafted PDF file, an attacker can trigger a buffer overflow, leading to a denial of service condition. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level. Exploitation of this vulnerability can result in the crashing of GhostScript, rendering it unavailable for further use.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update GhostScript to the latest version as soon as possible.
Conclusion
The buffer overflow vulnerability in GhostScript version 9.50 can be mitigated by updating to version 9.51 or later. Regularly updating software is crucial to address security vulnerabilities and ensure the stability of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability allows a remote attacker to cause a denial of service by exploiting a buffer overflow issue in GhostScript. It can result in the crashing of GhostScript, rendering it unavailable for further use.
To fix this vulnerability, update GhostScript to version 9.51 or later. Regularly updating software is essential to mitigate security risks.
No specific workaround has been provided for this vulnerability. It is recommended to update GhostScript to the latest version.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
