Memcpy-param-overlap in ghostscript: gs_fapi_do_char
Summary
OSV-2021-1731: Memcpy-param-overlap in gs_fapi_do_char. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 0f8c0b5742577e31e419e84fbf0bcd42db0c5f41. Fixed in 0f8c0b5742577e31e419e84fbf0bcd42db0c5f41. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability in question, gs_fapi_do_char, affects the functionality of Ghostscript related to font handling and character rendering.
Vulnerability Detail
The vulnerability, identified as Memcpy-param-overlap, was reported through the OSS-Fuzz project. It occurs when the memcpy function is called with overlapping source and destination memory regions. In the case of gs_fapi_do_char, this can lead to a crash. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
Minimum fixed version
0f8c0b5742577e31e419e84fbf0bcd42db0c5f41
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using an updated version of Ghostscript that includes the fix.
Conclusion
In conclusion, the Memcpy-param-overlap vulnerability in gs_fapi_do_char of Ghostscript can potentially lead to code execution or denial-of-service. It is crucial to update Ghostscript to a version that includes the fix to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update Ghostscript to a version that includes the fix. Refer to the provided commit in the Git repository for the specific fix.
There is no specific workaround mentioned for this vulnerability. However, using an updated version of Ghostscript can mitigate the risk.
For more information, refer to the provided OSS-Fuzz report and the source link in the database-specific details section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
