UNKNOWN READ vulnerability in ghostscript
Summary
OSV-2021-1753: UNKNOWN READ in names_string_ref. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < cb1fec72cee2eab9cdda54dabe1db173c7a3ad9e. Fixed in cb1fec72cee2eab9cdda54dabe1db173c7a3ad9e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question affects the names_string_ref function in Ghostscript, which is responsible for handling glyph names in PDF files. This vulnerability can lead to an unknown read operation, potentially resulting in a crash or other unexpected behavior.
Vulnerability Detail
The vulnerability originates from a flaw in the names_string_ref function. When processing glyph names in PDF files, an unknown read operation can occur, leading to potential memory corruption or information disclosure. This vulnerability has a medium severity rating and has been reported through the OSS-Fuzz project. It is important to note that the exact impact and potential exploits of this vulnerability are not disclosed in the provided information.
How To Fix
Minimum fixed version
cb1fec72cee2eab9cdda54dabe1db173c7a3ad9e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. It is recommended to follow the steps for fixing the vulnerability as described above.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in Ghostscript can lead to potential memory corruption or information disclosure. It is recommended to update the Ghostscript package to a version that includes the fix or apply the necessary patches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact of this vulnerability is not disclosed in the provided information. However, it is categorized as having a medium severity rating.
To fix this vulnerability, update your Ghostscript installation to a version that includes the fix. The fix is available in commit cb1fec72cee2eab9cdda54dabe1db173c7a3ad9e or later.
No specific workaround is mentioned in the provided information. It is recommended to update to a fixed version of Ghostscript.
For more information about this vulnerability, you can refer to the OSS-Fuzz report linked in the provided information.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
