Buffer Overflow Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16305: A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and PDF file format. It is widely used for rendering and manipulating PDF documents. However, version 9.50 of GhostScript is vulnerable to a buffer overflow in the pcx_write_rle() function in the contrib/japanese/gdev10v.c file. This vulnerability can be exploited by a remote attacker through a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript v9.50 allows an attacker to cause a denial of service (DoS) by exploiting the pcx_write_rle() function. By sending a specially crafted PDF file, the attacker can trigger the buffer overflow, leading to a crash or system instability. This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The buffer overflow vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service. It is crucial to upgrade to version 9.51 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability can be exploited by a remote attacker to cause a denial of service (DoS) by crashing the GhostScript interpreter or causing system instability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of GhostScript is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
While the vulnerability has been identified, there is no known public exploit available at the moment. However, it is still important to apply the recommended fix to prevent any potential exploitation.
The recommended mitigation is to upgrade to version 9.51 of GhostScript or later, as it includes the fix for the buffer overflow vulnerability. Additionally, it is always advisable to follow secure coding practices and avoid opening untrusted PDF files.
You can find more information about this vulnerability in the CVE-2020-16305 JSON report available at: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-16305.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
