Division by Zero Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16299: A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability affects version 9.50 of GhostScript. GhostScript is vulnerable to a Division by Zero vulnerability in the bj10v_print_page() function in the gdev10v.c file. This vulnerability can be exploited by a remote attacker through a crafted PDF file.
Vulnerability Detail
The Division by Zero vulnerability in GhostScript v9.50 occurs in the bj10v_print_page() function. By exploiting this vulnerability, a remote attacker can cause a denial of service (DoS) by sending a specially crafted PDF file. The vulnerability is fixed in version 9.51 of GhostScript.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of GhostScript as soon as possible.
Conclusion
The Division by Zero vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service. It is recommended to update to version 9.51 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted PDF file.
To fix the vulnerability, update GhostScript to version 9.51 or later.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of GhostScript.
For more information about this vulnerability, you can refer to the CVE-2020-16299 entry in the National Vulnerability Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
