UNKNOWN READ Vulnerability in ghostscript
Summary
OSV-2021-1728: UNKNOWN READ in pdfi_dict_get. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is widely used for rendering PDF files and converting them to other formats. This vulnerability affects the ghostscript package and can potentially lead to a security breach.
Vulnerability Detail
The vulnerability, identified as OSV-2021-1728, involves an UNKNOWN READ crash type in the pdfi_dict_get function of ghostscript. This can be triggered by a specially crafted PDF file, causing a crash and potentially leading to arbitrary code execution. The severity of this vulnerability is considered medium.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can exercise caution when opening PDF files from untrusted sources. Avoiding opening suspicious or unknown PDF files can help reduce the risk of triggering this vulnerability.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in ghostscript can potentially lead to arbitrary code execution. It is crucial to update the ghostscript package to the latest version and exercise caution when handling PDF files from untrusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code by exploiting the crash in ghostscript. It is important to patch or update the software to prevent any potential security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Yes, it is recommended to update the ghostscript package to the latest version available. The maintainers of ghostscript have likely released a patch or an updated version that addresses this issue.
While updating the package is the recommended solution, you can exercise caution when opening PDF files from untrusted sources as a temporary workaround. Avoiding opening suspicious or unknown PDF files can help reduce the risk of triggering this vulnerability.
You can find more information about this vulnerability in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42687
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
