Division by Zero Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16310: A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability affects version 9.50 of GhostScript. GhostScript allows remote attackers to exploit a division by zero vulnerability in the dot24_print_page() function, which is located in the devices/gdevdm24.c file. This vulnerability can be triggered by a crafted PDF file.
Vulnerability Detail
The division by zero vulnerability in dot24_print_page() function of GhostScript v9.50 allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted PDF file. When the vulnerable function encounters the crafted PDF file, it performs a division operation with a divisor of zero, leading to a crash or termination of the GhostScript process. This vulnerability can be exploited remotely, potentially impacting systems that process untrusted PDF files. The vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of GhostScript as soon as possible.
Conclusion
The division by zero vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service. Users should update to the fixed version, 9.51, to mitigate the risk. It is recommended to regularly update software to ensure the latest security patches are applied. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows a remote attacker to cause a denial of service by providing a specially crafted PDF file. This can lead to the termination or crash of the GhostScript process, potentially disrupting the functionality of systems that process untrusted PDF files.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities, including this one.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to update to the fixed version to prevent potential exploitation.
Yes, the vulnerability has been fixed in version 9.51 of GhostScript. Users are strongly advised to update their installations to the latest version to ensure they are protected against this vulnerability.
Yes, this vulnerability can be exploited remotely. Attackers can send a specially crafted PDF file to a vulnerable system, triggering the division by zero vulnerability and causing a denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
