Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16302: A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF documents. The vulnerability affects version 9.50 of GhostScript and allows a remote attacker to escalate privileges through a crafted PDF file.
Vulnerability Detail
The vulnerability, identified as CVE-2020-16302, is a buffer overflow vulnerability in the jetp3852_print_page() function in the devices/gdev3852.c file of GhostScript. By exploiting this vulnerability, an attacker can execute arbitrary code with elevated privileges. This can lead to unauthorized access, data manipulation, or even a complete compromise of the affected system. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the official fix by updating to GhostScript version 9.51 or later.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges and execute arbitrary code. To mitigate this vulnerability, it is crucial to update GhostScript to version 9.51 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows a remote attacker to escalate privileges and execute arbitrary code on the affected system. This can lead to unauthorized access, data manipulation, or a complete compromise of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
No, only version 9.50 of GhostScript is affected by this vulnerability. Updating to version 9.51 or later will fix the issue.
There is no known exploit available in the public domain at the time of this report. However, it is crucial to apply the fix promptly to mitigate any potential risks.
You can find more information about this vulnerability in the CVE-2020-16302 entry at the Open Source Vulnerability Database (OSV).
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.