Use-After-Free Vulnerability in GhostScript
Summary
CVE-2020-16303: A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability, identified as CVE-2020-16303, affects GhostScript version 9.50. It is a use-after-free vulnerability in the xps_finish_image_path() function in the gdevxps.c file. This vulnerability allows a remote attacker to escalate privileges by exploiting a crafted PDF file.
Vulnerability Detail
The use-after-free vulnerability in GhostScript arises from improper memory management. When processing a specially crafted PDF file, the xps_finish_image_path() function fails to properly handle memory deallocation, leading to a use-after-free condition. An attacker can exploit this vulnerability to execute arbitrary code with elevated privileges, potentially compromising the entire system. The impact of this vulnerability is severe, as it allows an attacker to gain control over the affected system.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating GhostScript to the latest version.
Conclusion
The use-after-free vulnerability in GhostScript (CVE-2020-16303) poses a significant risk to systems running the affected version. It is crucial to update GhostScript to version 9.51 or later to address this vulnerability. Failure to do so may result in unauthorized access, data theft, or other malicious activities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code.
An attacker can exploit this vulnerability by crafting a malicious PDF file and tricking a user into opening it. When the vulnerable version of GhostScript processes the file, the attacker's code can be executed with elevated privileges.
The impact of this vulnerability is severe. An attacker can gain control over the affected system, potentially leading to unauthorized access, data theft, or further compromise of the system.
To protect your system, it is crucial to update GhostScript to version 9.51 or later. Regularly applying security updates and patches is also recommended to mitigate the risk of known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.