Heap-buffer-overflow in ghostscript: pdfi_dereference
Summary
OSV-2021-1685: Heap-buffer-overflow in pdfi_dereference. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 632230836e6a5aa347c037a66f478d752b62242a. Fixed in 632230836e6a5aa347c037a66f478d752b62242a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, identified as OSV-2021-1685, is a heap-buffer-overflow in the pdfi_dereference function of Ghostscript. This function is responsible for dereferencing PDF objects. The vulnerability can be triggered by a specially crafted PDF file, potentially leading to a crash or arbitrary code execution.
Vulnerability Detail
The vulnerability arises due to a heap-buffer-overflow in the pdfi_dereference function. When processing a PDF file, the function fails to properly validate the size of a buffer, resulting in a read overflow of 8 bytes. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability has a medium severity rating.
How To Fix
Minimum fixed version
632230836e6a5aa347c037a66f478d752b62242a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a patched version of Ghostscript to mitigate the risk.
Conclusion
In conclusion, the vulnerability identified as OSV-2021-1685 in Ghostscript's pdfi_dereference function is a heap-buffer-overflow issue that can potentially lead to arbitrary code execution or crashes. It is crucial to update to a patched version of Ghostscript to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability can potentially lead to a crash or arbitrary code execution when processing a specially crafted PDF file.
To fix this vulnerability, update your Ghostscript installation to a version that includes the fix.
No, there is no known workaround for this vulnerability. Updating to a patched version is the recommended solution.
This vulnerability has a medium severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
