Stack-buffer-overflow in pdfi_create_iccbased in ghostscript
Summary
OSV-2021-1704: Stack-buffer-overflow in pdfi_create_iccbased. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < d066f5000d9a959708838c0ee471ffeb84d00bfc. Fixed in d066f5000d9a959708838c0ee471ffeb84d00bfc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PostScript and PDF files. The vulnerability in question, identified as OSV-2021-1704, affects the pdfi_create_iccbased function in Ghostscript. This function is responsible for creating an ICC-based color space. The vulnerability allows for a stack-buffer-overflow WRITE 4, which can lead to a crash or potentially be exploited for arbitrary code execution.
Vulnerability Detail
The stack-buffer-overflow vulnerability in pdfi_create_iccbased can be triggered when processing a specially crafted PDF file. An attacker could exploit this vulnerability to crash the application or execute arbitrary code with the privileges of the user running Ghostscript. The vulnerability was discovered through OSS-Fuzz, and the affected versions range from the commit 75fbddf52051987287e62d13c659eb73ba16982f to the commit d066f5000d9a959708838c0ee471ffeb84d00bfc in the Ghostscript Git repository.
How To Fix
Minimum fixed version
d066f5000d9a959708838c0ee471ffeb84d00bfc
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider using alternative PDF processing libraries or tools until a patched version of Ghostscript is available. This can help mitigate the risk of exploitation through this specific vulnerability.
Conclusion
The stack-buffer-overflow vulnerability in pdfi_create_iccbased in Ghostscript can lead to a crash or potential code execution. It is crucial to update Ghostscript to a version that includes the fix for this vulnerability to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PostScript and PDF files.
This vulnerability can lead to a crash of the application or potentially allow an attacker to execute arbitrary code with the privileges of the user running Ghostscript.
This vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software.
The vulnerability affects versions of Ghostscript from the commit 75fbddf52051987287e62d13c659eb73ba16982f to the commit d066f5000d9a959708838c0ee471ffeb84d00bfc in the Git repository.
To protect your system, it is recommended to update Ghostscript to a version that includes the fix for this vulnerability. Regularly updating the software is important to ensure that the latest security patches are applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
