Buffer Overflow Vulnerability in GhostScript
Summary
CVE-2020-16308: A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability, identified as CVE-2020-16308, is a buffer overflow issue in the p_print_image() function of the devices/gdevcdj.c file in GhostScript version 9.50. This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript version 9.50 arises from improper handling of image data in the p_print_image() function. By supplying a specially crafted PDF file, an attacker can trigger a buffer overflow, leading to a crash or potential arbitrary code execution. The impact of this vulnerability can range from a denial of service to potential remote code execution on systems running the affected version of GhostScript.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating GhostScript to version 9.51 or later.
Conclusion
The buffer overflow vulnerability in GhostScript version 9.50 can be exploited by a remote attacker to cause a denial of service or potentially execute arbitrary code. It is crucial to update GhostScript to version 9.51 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file. In some cases, it may also lead to potential remote code execution.
To fix this vulnerability, update GhostScript to version 9.51 or later. This update includes a fix for the buffer overflow issue in the p_print_image() function.
No, there is no known workaround for this vulnerability. It is recommended to update GhostScript to the latest version.
For more information about this vulnerability, refer to the CVE-2020-16308 entry in the National Vulnerability Database (NVD) or the provided database-specific source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
