Buffer Overflow Vulnerability in GhostScript v9.50
Summary
CVE-2020-16297: A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability affects version 9.50 of GhostScript. This version contains a buffer overflow vulnerability in the FloydSteinbergDitheringC() function in the contrib/gdevbjca.c file. This vulnerability can be exploited by a remote attacker through a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript v9.50 allows a remote attacker to cause a denial of service (DoS) by exploiting the FloydSteinbergDitheringC() function with a specially crafted PDF file. This can lead to the application crashing or becoming unresponsive. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level. It was first published on August 13, 2020, and fixed in version 9.51 of GhostScript.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version as soon as possible.
Conclusion
The buffer overflow vulnerability in GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service. It is crucial to update to version 9.51 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a buffer overflow in GhostScript. This can lead to the application crashing or becoming unresponsive.
To fix the vulnerability, update GhostScript to version 9.51 or later. This version includes the necessary patches to address the buffer overflow issue.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
