Segv on unknown address in chunk_obj_alloc in ghostscript
Summary
OSV-2021-1724: Segv on unknown address in chunk_obj_alloc. Affects ghostscript versions >= 1a3c64e7a65025ea024bd65cc726b6ec5dd0e172, < 47e220942dfc68de777b91db1c2b3e81d0275e1b. Fixed in 47e220942dfc68de777b91db1c2b3e81d0275e1b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability in question, identified as OSV-2021-1724, affects the ghostscript package and can lead to a segmentation fault (Segv) when an unknown address is encountered during the chunk_obj_alloc process.
Vulnerability Detail
The vulnerability arises from a segmentation fault that occurs when an unknown address is accessed in the chunk_obj_alloc function. This can be triggered during the allocation of chunks, leading to a crash. The impact of this vulnerability can vary depending on the context in which ghostscript is used. In certain scenarios, an attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition.
How To Fix
Minimum fixed version
47e220942dfc68de777b91db1c2b3e81d0275e1b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider avoiding the use of ghostscript in scenarios where untrusted PDF files or PostScript documents are processed. By limiting exposure to potentially malicious inputs, the risk associated with this vulnerability can be mitigated.
Conclusion
In conclusion, the Segv on unknown address vulnerability in ghostscript can lead to crashes and potential security risks. It is crucial to update the ghostscript package to a version that includes the fix or consider implementing workarounds to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The impact of this vulnerability can vary depending on the context in which ghostscript is used. In certain scenarios, an attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition.
To fix this vulnerability, it is recommended to update the ghostscript package to a version that includes the fix. The fix was implemented in commit 47e220942dfc68de777b91db1c2b3e81d0275e1b in the ghostpdl.git repository.
As a workaround, users can consider avoiding the use of ghostscript in scenarios where untrusted PDF files or PostScript documents are processed. By limiting exposure to potentially malicious inputs, the risk associated with this vulnerability can be mitigated.
You can find more information about this vulnerability in the OSS-Fuzz report: [link to the report]
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
