Heap-use-after-free vulnerability in ghostscript
Summary
OSV-2021-1081: Heap-use-after-free in gx_pattern_accum_finalize_cw. Affects ghostscript across 2 version ranges.
>= 4d2bf7b009922bef2efdbc3d0c8dcfe5d3a8cdb0, < 6a4847cd2566e8446753fd0ba17fe2f42c6e0315
>= 6cd65db61b4285365b930adad85c0ca0c54a7dc4
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question is a heap-use-after-free issue that has been identified in the gx_pattern_accum_finalize_cw function of Ghostscript. This function is responsible for finalizing a pattern accumulation in the context of a color wheel. The vulnerability can be triggered when certain operations are performed on a pattern accumulation object, leading to a use-after-free condition in the heap memory.
Vulnerability Detail
The vulnerability arises due to improper handling of memory in the gx_pattern_accum_finalize_cw function. When this function is called, it attempts to finalize a pattern accumulation object. However, due to a flaw in the code, the function does not properly handle the deallocation of memory associated with the object. As a result, a use-after-free condition can occur, where the program continues to access the freed memory, leading to potential crashes or the execution of arbitrary code. This vulnerability has been assigned a severity rating of HIGH.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider avoiding the use of operations that trigger the vulnerable code path. This may involve modifying the code or configuration to avoid using the specific functionality that leads to the vulnerability. However, it is strongly recommended to apply the official fix provided by the Ghostscript project.
Conclusion
In conclusion, the heap-use-after-free vulnerability in Ghostscript's gx_pattern_accum_finalize_cw function can lead to crashes or the execution of arbitrary code. It is important to update to a fixed version of Ghostscript to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause the application to crash, leading to a denial-of-service condition.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
No, not all versions of Ghostscript are affected. The vulnerability was introduced in versions starting from 4d2bf7b009922bef2efdbc3d0c8dcfe5d3a8cdb0 and was fixed in versions from 6a4847cd2566e8446753fd0ba17fe2f42c6e0315.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
You can find more information about this vulnerability, including the source code changes and the OSS-Fuzz report, in the vulnerability database entry at https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-1081.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
