UNKNOWN READ vulnerability in ghostscript: pdfi_open_memory_stream_from_filtered_stream
Summary
OSV-2021-1684: UNKNOWN READ in pdfi_open_memory_stream_from_filtered_stream. Affects ghostscript versions >= 6a4847cd2566e8446753fd0ba17fe2f42c6e0315, < 7fe54b1dbf221864b25ff55eccf1d624c07bb21d. Fixed in 7fe54b1dbf221864b25ff55eccf1d624c07bb21d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability in question, pdfi_open_memory_stream_from_filtered_stream, affects the functionality of Ghostscript and can lead to unknown read operations. This vulnerability has been identified and reported through the OSS-Fuzz project.
Vulnerability Detail
The UNKNOWN READ vulnerability in Ghostscript arises from the pdfi_open_memory_stream_from_filtered_stream function. When processing certain PDF files, this function can trigger an unknown read operation. The specific crash state indicates that the vulnerability occurs during the execution of pdfi_create_iccbased and pdfi_create_colorspace_by_array functions. The impact of this vulnerability is not explicitly mentioned, but it can potentially lead to information disclosure or other security issues.
How To Fix
Minimum fixed version
7fe54b1dbf221864b25ff55eccf1d624c07bb21d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in Ghostscript's pdfi_open_memory_stream_from_filtered_stream function can lead to unknown read operations during the processing of certain PDF files. It is recommended to update Ghostscript to a version that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The impact of this vulnerability is not explicitly mentioned, but it can potentially lead to information disclosure or other security issues.
To fix this vulnerability, it is recommended to update Ghostscript to a version that includes the fix. The fix was implemented in commit 7fe54b1dbf221864b25ff55eccf1d624c07bb21d in the Git repository of Ghostscript.
No specific workaround has been mentioned for this vulnerability.
More information about this vulnerability can be found in the OSS-Fuzz report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
