Null Pointer Dereference Vulnerability in GhostScript
Summary
CVE-2020-16295: A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability identified as CVE-2020-16295 affects GhostScript versions up to 9.50. GhostScript allows remote attackers to exploit a null pointer dereference vulnerability in the clj_media_size() function, which is located in the devices/gdevclj.c file. This vulnerability can be triggered by a crafted PDF file, leading to a denial of service (DoS) condition. The vulnerability has been fixed in version 9.51 of GhostScript.
Vulnerability Detail
The null pointer dereference vulnerability in clj_media_size() function of GhostScript allows a remote attacker to cause a denial of service by exploiting a flaw in the handling of crafted PDF files. By sending a specially crafted PDF file to a vulnerable system, an attacker can trigger the vulnerability, resulting in a crash or termination of the GhostScript process. This can lead to a DoS condition, impacting the availability of the affected system. The vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to update to the fixed version of GhostScript as soon as possible.
Conclusion
The null pointer dereference vulnerability in GhostScript can be exploited by a remote attacker through a crafted PDF file, leading to a denial of service condition. To mitigate this vulnerability, it is crucial to update GhostScript to version 9.51 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a flaw in the handling of crafted PDF files. This can lead to a crash or termination of the GhostScript process, impacting the availability of the affected system.
To fix this vulnerability, it is recommended to update GhostScript to version 9.51 or later. This version includes the necessary patches to address the null pointer dereference vulnerability.
No, there is no known workaround for this vulnerability. It is advised to update to the fixed version of GhostScript as soon as possible.
The CVSSv3 score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
