Global-buffer-overflow in ps_font_def_func in ghostscript
Summary
OSV-2021-1723: Global-buffer-overflow in ps_font_def_func. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 74da5c5f368ea314867b26abfe96b31e6d8e4e8f. Fixed in 74da5c5f368ea314867b26abfe96b31e6d8e4e8f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PostScript and PDF files. The ps_font_def_func function in Ghostscript is responsible for defining font functions for PostScript fonts. This vulnerability, identified as OSV-2021-1723, is a global buffer overflow that can be triggered when processing a specially crafted PostScript font file. The vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software. It affects versions of Ghostscript up to 9.55.0.
Vulnerability Detail
The global buffer overflow vulnerability in ps_font_def_func can lead to a read access violation. An attacker can exploit this vulnerability by providing a malicious PostScript font file, which, when processed by Ghostscript, triggers the buffer overflow. This can result in arbitrary code execution or a denial of service condition. The vulnerability was fixed in commit 74da5c5f368ea314867b26abfe96b31e6d8e4e8f in the Ghostscript Git repository.
How To Fix
Minimum fixed version
74da5c5f368ea314867b26abfe96b31e6d8e4e8f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid processing untrusted PostScript font files with Ghostscript until the software is updated to a fixed version. Additionally, it is recommended to apply proper input validation and sanitization to any user-supplied files processed by Ghostscript.
Conclusion
In conclusion, the global buffer overflow vulnerability in ps_font_def_func in Ghostscript can be exploited by providing a malicious PostScript font file. This can result in arbitrary code execution or a denial of service condition. It is recommended to update Ghostscript to version 9.55.0 or later to fix the vulnerability. Users can also apply the provided workaround and exercise caution when processing untrusted PostScript font files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PostScript and PDF files.
ps_font_def_func is a function in Ghostscript that is responsible for defining font functions for PostScript fonts.
This vulnerability can be exploited by providing a specially crafted PostScript font file, which triggers a global buffer overflow when processed by Ghostscript.
The global buffer overflow can lead to arbitrary code execution or a denial of service condition, depending on how the vulnerability is exploited.
Yes, this vulnerability has been fixed in Ghostscript version 9.55.0. Users are advised to update to the latest version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
