Stack-buffer-underflow in read_xref in ghostscript
Summary
OSV-2021-1689: Stack-buffer-underflow in read_xref. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < d3cd74af319b7b9bc72b6328bdd79fb4ff8082c3. Fixed in d3cd74af319b7b9bc72b6328bdd79fb4ff8082c3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF documents. The vulnerability in question, identified as OSV-2021-1689, is a stack-buffer-underflow issue that affects the read_xref function in Ghostscript. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.
Vulnerability Detail
The stack-buffer-underflow vulnerability occurs when the read_xref function in Ghostscript attempts to write data beyond the bounds of a stack buffer. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the application. The vulnerability was discovered through an OSS-Fuzz report and has been assigned the ID OSV-2021-1689. The affected version range of Ghostscript is from commit 75fbddf52051987287e62d13c659eb73ba16982f to commit d3cd74af319b7b9bc72b6328bdd79fb4ff8082c3 in the git repository git://git.ghostscript.com/ghostpdl.git.
How To Fix
Minimum fixed version
d3cd74af319b7b9bc72b6328bdd79fb4ff8082c3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider implementing input validation and sanitization mechanisms to prevent malicious inputs from triggering the vulnerability. However, this is not a foolproof solution and should be seen as a temporary measure until the software is updated to a fixed version.
Conclusion
In conclusion, the stack-buffer-underflow vulnerability in the read_xref function of Ghostscript can potentially allow an attacker to execute arbitrary code or crash the application. It is crucial to update Ghostscript to a fixed version and follow secure coding practices to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or crash the application, leading to a potential compromise of the system or denial-of-service.
The vulnerability was discovered through an OSS-Fuzz report, which is a continuous fuzzing service for open-source software.
No, only versions from commit 75fbddf52051987287e62d13c659eb73ba16982f to commit d3cd74af319b7b9bc72b6328bdd79fb4ff8082c3 in the git repository git://git.ghostscript.com/ghostpdl.git are affected.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the recommended fixes to mitigate the risk.
It is strongly recommended to update Ghostscript to a version that includes the fix for this vulnerability. You can check if your application is affected using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
