Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16298: A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF documents. The vulnerability affects version 9.50 of GhostScript. GhostScript allows remote attackers to exploit a buffer overflow vulnerability in the mj_color_correct() function, which is located in the contrib/japanese/gdevmjc.c file. This vulnerability can be triggered by a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in mj_color_correct() function of GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service (DoS) attack. By sending a specially crafted PDF file, the attacker can trigger the buffer overflow, leading to the crash of the GhostScript interpreter. This vulnerability can potentially be used to execute arbitrary code or escalate privileges on the affected system. The vulnerability has been assigned the CVE identifier CVE-2020-16298 and has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of GhostScript as soon as possible.
Conclusion
In conclusion, the buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service attack. It is crucial to update to the latest version of GhostScript (v9.51 or later) to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF documents.
This vulnerability allows a remote attacker to cause a denial of service (DoS) attack by sending a specially crafted PDF file. It can potentially be used to execute arbitrary code or escalate privileges on the affected system.
To fix this vulnerability, it is recommended to update GhostScript to version 9.51 or later. The fix for this vulnerability is included in GhostScript version 9.51.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of GhostScript as soon as possible.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
