Null Pointer Dereference Vulnerability in Artifex Software GhostScript v9.50
Summary
CVE-2020-16307: A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Software GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating documents. The vulnerability affects version 9.50 of GhostScript. GhostScript processes postscript files, and due to a null pointer dereference vulnerability in the 'gdevtxtw.c' and 'zbfont.c' files, a remote attacker can exploit this vulnerability to cause a denial of service. This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
Vulnerability Detail
The null pointer dereference vulnerability in Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service by sending a crafted postscript file. The vulnerability originates from the 'gdevtxtw.c' and 'zbfont.c' files. When GhostScript processes the malicious file, it encounters a null pointer, leading to a crash or termination of the application. This can result in a denial of service, disrupting the normal functioning of the software. The vulnerability has been fixed in version 9.51 of GhostScript.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of GhostScript to mitigate the risk of exploitation.
Conclusion
The null pointer dereference vulnerability in Artifex Software GhostScript v9.50 can be exploited by a remote attacker to cause a denial of service. It is crucial to update to version 9.51 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted postscript file. This can disrupt the normal functioning of the GhostScript software.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in version 9.51 of GhostScript. It is recommended to update to this version or later to mitigate the risk.
There are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
You can download the fixed version of GhostScript (v9.51 or later) from the official Artifex Software website or through package managers specific to your operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
