Buffer Overflow Vulnerability in GhostScript
Summary
CVE-2020-16304: A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating images and documents. The vulnerability, identified as CVE-2020-16304, is a buffer overflow issue in the image_render_color_thresh() function of the base/gxicolor.c file in GhostScript version 9.50. This vulnerability allows a remote attacker to escalate privileges by exploiting a crafted EPS file. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript arises from improper handling of input data in the image_render_color_thresh() function. By providing a specially crafted EPS file, an attacker can trigger a buffer overflow, potentially leading to arbitrary code execution or privilege escalation. This vulnerability can be exploited remotely, making it a significant concern for systems running affected versions of GhostScript.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to update to the fixed version of GhostScript as mentioned in the 'how_to_fix' section.
Conclusion
The buffer overflow vulnerability in GhostScript (CVE-2020-16304) poses a moderate security risk. It is crucial to update to GhostScript version 9.51 or later to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating images and documents.
The vulnerability allows a remote attacker to escalate privileges by exploiting a crafted EPS file. This can lead to arbitrary code execution or privilege escalation on systems running affected versions of GhostScript.
To fix this vulnerability, update GhostScript to version 9.51 or later. This update includes a fix for the buffer overflow issue in the image_render_color_thresh() function.
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed version of GhostScript.
The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
