Heap-buffer-overflow in cmap_endcodespacerange_func in ghostscript
Summary
OSV-2021-1711: Heap-buffer-overflow in cmap_endcodespacerange_func. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 1a3c64e7a65025ea024bd65cc726b6ec5dd0e172. Fixed in 1a3c64e7a65025ea024bd65cc726b6ec5dd0e172. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, identified as OSV-2021-1711, is a heap-buffer-overflow issue that affects the cmap_endcodespacerange_func function in Ghostscript. This function is responsible for handling the endcodespacerange operator in the CMap (character mapping) module. The vulnerability can be triggered by a specially crafted PDF file, potentially leading to arbitrary code execution or a denial-of-service condition.
Vulnerability Detail
The heap-buffer-overflow vulnerability in cmap_endcodespacerange_func arises due to improper bounds checking when processing certain input data. An attacker can exploit this flaw by providing a malicious PDF file containing specially crafted endcodespacerange operators. When the vulnerable function attempts to process these operators, it may write beyond the boundaries of the allocated buffer, resulting in a heap-buffer-overflow write. This can lead to memory corruption, crashes, and potentially arbitrary code execution. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
1a3c64e7a65025ea024bd65cc726b6ec5dd0e172
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider disabling the CMap module in Ghostscript. This can be achieved by modifying the Ghostscript configuration file to exclude the CMap module from the list of modules loaded during execution. However, this workaround may impact the functionality of certain PDF files that rely on CMap for proper rendering and character mapping.
Conclusion
In conclusion, the heap-buffer-overflow vulnerability in cmap_endcodespacerange_func in Ghostscript can be exploited by providing a specially crafted PDF file. It is recommended to update the Ghostscript package to a version that includes the fix or consider disabling the CMap module as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
A heap-buffer-overflow vulnerability occurs when a program writes data beyond the boundaries of an allocated buffer in the heap. This can lead to memory corruption, crashes, and potentially arbitrary code execution.
An attacker can exploit this vulnerability by providing a specially crafted PDF file that triggers the vulnerable code path in Ghostscript. By exploiting the heap-buffer-overflow, the attacker may be able to execute arbitrary code or cause a denial-of-service condition.
This vulnerability has been assigned a severity rating of HIGH.
Yes, the vulnerability has been fixed in the Ghostscript Git repository. Users should update their installations to a version that includes the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
