Use-of-uninitialized-value in ghostscript: zcheck_r6_password
Summary
OSV-2020-1873: Use-of-uninitialized-value in zcheck_r6_password. Affects ghostscript versions >= 668917a10e7eada030f7d2dddec9f579fddeed3d, < 0339cbecea80d8a835b316b56d1c75a6fb850e52. Fixed in 0339cbecea80d8a835b316b56d1c75a6fb850e52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, zcheck_r6_password, affects the password checking function in Ghostscript. This function is responsible for validating passwords used to protect PDF files. The vulnerability allows an attacker to exploit an uninitialized value, potentially leading to crashes or other security issues.
Vulnerability Detail
The use-of-uninitialized-value vulnerability in zcheck_r6_password arises from a flaw in the Ghostscript code. When processing a PDF file with a password, the function fails to properly initialize a value, which can result in the use of uninitialized memory. This can lead to crashes or potentially allow an attacker to execute arbitrary code. The vulnerability was discovered through an OSS-Fuzz report and has a medium severity rating. The affected range of the vulnerability is unknown, but it was introduced in commit 668917a10e7eada030f7d2dddec9f579fddeed3d and fixed in commit 0339cbecea80d8a835b316b56d1c75a6fb850e52.
How To Fix
Minimum fixed version
0339cbecea80d8a835b316b56d1c75a6fb850e52
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using password-protected PDF files with Ghostscript until the vulnerability is fixed. If password protection is necessary, alternative PDF processing libraries or tools can be considered as a temporary solution.
Conclusion
The use-of-uninitialized-value vulnerability in Ghostscript's zcheck_r6_password function can result in crashes or potential code execution. It is recommended to update to a fixed version of Ghostscript or consider alternative PDF processing libraries. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
zcheck_r6_password is a function in Ghostscript responsible for checking passwords used to protect PDF files.
The vulnerability can lead to crashes or potentially allow an attacker to execute arbitrary code.
The vulnerability was discovered through an OSS-Fuzz report.
The vulnerability has a medium severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
