Null Pointer Dereference Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16306: A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents. However, version 9.50 of GhostScript is vulnerable to a null pointer dereference issue in the devices/gdevtsep.c file. This vulnerability can be exploited by a remote attacker through a crafted postscript file, leading to a denial of service.
Vulnerability Detail
The null pointer dereference vulnerability in Artifex Software GhostScript v9.50 occurs in the devices/gdevtsep.c file. When processing a specially crafted postscript file, the software fails to handle a null pointer, resulting in a crash or termination of the program. This vulnerability can be exploited remotely by an attacker, potentially causing a denial of service. The impact of this vulnerability is limited to the availability of the affected system and does not allow for arbitrary code execution or privilege escalation.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Artifex Software GhostScript to mitigate the risk.
Conclusion
The null pointer dereference vulnerability in Artifex Software GhostScript v9.50 can be mitigated by updating to version 9.51 or later. This update includes a patch that addresses the vulnerability. It is important to promptly apply the fix to ensure the security and stability of the software. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows a remote attacker to cause a denial of service by exploiting a null pointer dereference issue in Artifex Software GhostScript v9.50.
No, this vulnerability only leads to a denial of service and does not allow for arbitrary code execution or privilege escalation.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
To fix this vulnerability, update to version 9.51 or later of Artifex Software GhostScript. This version includes a patch for the null pointer dereference issue.
The fixed version of Artifex Software GhostScript (v9.51) can be downloaded from the official Artifex Software website or through your package manager.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
