Buffer Overflow Vulnerability in GhostScript
Summary
CVE-2020-16301: A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability, identified as CVE-2020-16301, is a buffer overflow issue in the okiibm_print_page1() function of the devices/gdevokii.c file in GhostScript version 9.50. This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript version 9.50 arises from improper handling of input data in the okiibm_print_page1() function. By sending a specially crafted PDF file, an attacker can trigger a buffer overflow, leading to a crash or potential code execution. This vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level. It is important to note that this vulnerability has been fixed in GhostScript version 9.51.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of GhostScript to mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in GhostScript version 9.50 can be mitigated by updating to version 9.51 or later. It is crucial to promptly apply the necessary patches to ensure the security and stability of the software. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file. It could potentially lead to a crash or code execution.
The CVSSv3 score of this vulnerability is 5.5, indicating a moderate severity level.
Yes, this vulnerability has been fixed in GhostScript version 9.51.
To update GhostScript, you can download the latest version from the official GhostScript website or through your package manager.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
