Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16294: A buffer overflow vulnerability in epsc_print_page() in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is widely used for rendering PDF files and executing PostScript programs. GhostScript provides a comprehensive set of functions for processing and manipulating PDF documents. However, a buffer overflow vulnerability has been discovered in the epsc_print_page() function of GhostScript v9.50. This vulnerability can be exploited by a remote attacker through a crafted PDF file, leading to a denial of service.
Vulnerability Detail
The buffer overflow vulnerability in epsc_print_page() allows an attacker to overwrite the buffer and potentially execute arbitrary code. By sending a specially crafted PDF file, an attacker can trigger the buffer overflow and cause the GhostScript interpreter to crash, resulting in a denial of service. This vulnerability can be exploited remotely, making it a significant security concern. The vulnerability has been assigned the CVE identifier CVE-2020-16294 and has a CVSS score of 5.5.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to GhostScript v9.51 or later.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be exploited remotely by sending a specially crafted PDF file, resulting in a denial of service. To mitigate this vulnerability, users should update their installations to GhostScript v9.51 or later. No known workaround is available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is widely used for rendering PDF files and executing PostScript programs.
This vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted PDF file. It can potentially crash the GhostScript interpreter, disrupting the availability of the affected system.
An attacker can exploit this vulnerability by sending a crafted PDF file to the target system. When the file is processed by GhostScript, the buffer overflow occurs, leading to a denial of service.
Yes, this vulnerability has been fixed in GhostScript version 9.51. Users are advised to update their installations to the latest version to mitigate the risk.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating to GhostScript v9.51 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
