Global-buffer-overflow in pdfi_fapi_get_glyph in ghostscript
Summary
OSV-2021-1693: Global-buffer-overflow in pdfi_fapi_get_glyph. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < a78a6db2d1f411c2aa76ea3c0f025cc31f117469. Fixed in a78a6db2d1f411c2aa76ea3c0f025cc31f117469. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PostScript and PDF files. The vulnerability in question, identified as OSV-2021-1693, is a global buffer overflow in the function pdfi_fapi_get_glyph. This vulnerability allows an attacker to read beyond the boundaries of a buffer, potentially leading to remote code execution or information disclosure.
Vulnerability Detail
The global buffer overflow vulnerability occurs in the pdfi_fapi_get_glyph function of Ghostscript. When processing a specially crafted PDF file, the function fails to properly validate user-supplied input, leading to a buffer overflow. This can be exploited by an attacker to overwrite adjacent memory and execute arbitrary code or leak sensitive information. The vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software.
How To Fix
Minimum fixed version
a78a6db2d1f411c2aa76ea3c0f025cc31f117469
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix provided by the Ghostscript project.
Conclusion
The global buffer overflow vulnerability in Ghostscript's pdfi_fapi_get_glyph function poses a significant risk of remote code execution or information disclosure. It is crucial to update Ghostscript to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PostScript and PDF files.
This vulnerability can allow an attacker to execute arbitrary code or leak sensitive information by exploiting the buffer overflow in Ghostscript.
This vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software.
No, there is no known workaround for this vulnerability. It is crucial to update Ghostscript to the fixed version provided by the project.
To update Ghostscript, you can follow the official documentation or use package managers like apt, yum, or homebrew, depending on your operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
