Buffer Overflow Vulnerability in GhostScript
Summary
CVE-2020-17538: A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. Affects ghostscript versions < 9.51-r0. Fixed in 9.51-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability identified as CVE-2020-17538 is a buffer overflow vulnerability in the GetNumSameData() function of the GhostScript library. This vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file.
Vulnerability Detail
The buffer overflow vulnerability in GetNumSameData() function of GhostScript v9.50 can be exploited by an attacker through a specially crafted PDF file. By sending this malicious file to a vulnerable system, the attacker can trigger a buffer overflow, leading to a denial of service condition. The impact of this vulnerability can range from crashing the GhostScript interpreter to potentially executing arbitrary code on the target system. The vulnerability has been assigned a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.51-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the fixed version of GhostScript to mitigate the risk.
Conclusion
The buffer overflow vulnerability in GhostScript can be exploited by a remote attacker through a specially crafted PDF file, leading to a denial of service condition. To mitigate this risk, it is crucial to update GhostScript to version 9.51 or later. This update includes a patch that addresses the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
GhostScript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a crafted PDF file. It can lead to crashing the GhostScript interpreter or potentially executing arbitrary code on the target system.
To fix this vulnerability, update GhostScript to version 9.51 or later. The latest version includes a patch that addresses the buffer overflow issue.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
