Buffer Overflow Vulnerability in GhostScript v9.50
Summary
CVE-2020-16309: A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted eps file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability affects GhostScript version 9.50 and allows a remote attacker to cause a denial of service by exploiting a buffer overflow in the lxm5700m_print_page() function in the devices/gdevlxm.c file. This vulnerability has a CVSS score of 5.5.
Vulnerability Detail
The buffer overflow vulnerability in GhostScript v9.50 occurs when processing a crafted EPS file. An attacker can exploit this vulnerability remotely, potentially leading to a denial of service. By sending a specially crafted EPS file to a vulnerable instance of GhostScript, an attacker can trigger the buffer overflow, causing the application to crash or become unresponsive. This vulnerability is fixed in GhostScript v9.51.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The buffer overflow vulnerability in GhostScript v9.50 can be exploited remotely, leading to a denial of service. It is crucial to update to version 9.51 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a buffer overflow in GhostScript. This can result in the application crashing or becoming unresponsive.
To fix this vulnerability, update GhostScript to version 9.51 or later. This update includes patches to address the buffer overflow vulnerability.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed version of GhostScript.
For more information about this vulnerability, refer to the CVE-2020-16309 entry in the National Vulnerability Database (NVD) or the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
