Vulnerability in ghostscript: UNKNOWN READ in mem_mapped4_fill_rectangle
Summary
OSV-2020-1876: UNKNOWN READ in mem_mapped4_fill_rectangle. Affects ghostscript across 2 version ranges.
< b9a4616cdf710c79f575adb33b331cb495461d93
>= d1eac80695b2c6f2a85942a82518715549541969, < 748edd2fd75c684d63486eded71ad20254de6f4c
Fixed in 748edd2fd75c684d63486eded71ad20254de6f4c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question affects the mem_mapped4_fill_rectangle function within Ghostscript. This function is responsible for filling rectangles with a specific color. However, due to a flaw, an unknown read operation can occur, leading to potential security issues.
Vulnerability Detail
The vulnerability arises from an unknown read operation in the mem_mapped4_fill_rectangle function of Ghostscript. This can result in unexpected behavior and potentially allow an attacker to access sensitive information or execute arbitrary code. The exact impact and potential ramifications of this vulnerability are not specified in the available information.
How To Fix
Minimum fixed version
748edd2fd75c684d63486eded71ad20254de6f4c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the available information. It is advised to apply the fix by updating to a patched version of Ghostscript.
Conclusion
In conclusion, the vulnerability in Ghostscript's mem_mapped4_fill_rectangle function poses a potential security risk due to an unknown read operation. To mitigate this vulnerability, it is crucial to update Ghostscript to a version that includes the fix. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The exact impact of this vulnerability is not specified in the available information. However, it could potentially allow an attacker to access sensitive information or execute arbitrary code.
To fix this vulnerability, update Ghostscript to a version that includes the fix. The fix is available in versions 9.53.3 and later.
No specific workaround is mentioned in the available information. It is recommended to update to a patched version of Ghostscript.
For more information about this vulnerability, you can refer to the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
