Negative-size-param in general_endcidrange_func in ghostscript
Summary
OSV-2021-1707: Negative-size-param in general_endcidrange_func. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < cb2b78cddfc67fee13b4bec3f16747f2ec611793. Fixed in cb2b78cddfc67fee13b4bec3f16747f2ec611793. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF files. It is widely used for rendering and converting documents in various formats. The general_endcidrange_func function in Ghostscript is responsible for handling CID ranges in CMap files. A vulnerability has been discovered in this function that allows for a negative-size parameter, leading to a crash.
Vulnerability Detail
The vulnerability occurs when the general_endcidrange_func function in Ghostscript is called with a negative-size parameter. This can result in a crash, potentially leading to a denial of service or other security implications. The issue was reported through the OSS-Fuzz project and has been assigned the identifier OSV-2021-1707. More details can be found in the provided OSS-Fuzz report.
How To Fix
Minimum fixed version
cb2b78cddfc67fee13b4bec3f16747f2ec611793
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, a vulnerability has been discovered in the general_endcidrange_func function in Ghostscript that allows for a negative-size parameter. This can result in a crash, potentially leading to a denial of service or other security implications. Users are advised to update their installations to a patched version of Ghostscript that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an interpreter for the PostScript language and for PDF files. It is commonly used for rendering and converting documents in various formats.
This vulnerability can lead to a crash in Ghostscript, potentially resulting in a denial of service or other security implications.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open source software.
Yes, a fix for this vulnerability is available in the Ghostscript Git repository. Users should update their installations to a version that includes this fix.
There are no known workarounds for this vulnerability. It is recommended to apply the fix as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
