UNKNOWN READ vulnerability in ghostscript
Summary
OSV-2021-1772: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= 2be8b436910cfc8b013a13df000c3c854cf3c5c5, < 4affbf8fe0e5982058c498a33689cc5182eab0ed. Fixed in 4affbf8fe0e5982058c498a33689cc5182eab0ed. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. This vulnerability affects the ghostscript package and is related to an unknown read issue. The vulnerability can lead to a crash and is considered to have a medium severity level.
Vulnerability Detail
The vulnerability in ghostscript is related to an unknown read issue. When triggered, it can cause a crash in the chunk_free_object function, specifically in the gs_font_dir_finalize function. The exact cause and impact of the vulnerability are not specified in the provided information. However, it is important to note that unknown read vulnerabilities can potentially lead to information disclosure or other security issues.
How To Fix
Minimum fixed version
4affbf8fe0e5982058c498a33689cc5182eab0ed
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. It is recommended to follow the fix instructions and update the package to the latest version.
Conclusion
In conclusion, the ghostscript package is affected by an unknown read vulnerability that can lead to a crash. It is recommended to update the package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The exact impact of this vulnerability is not specified in the provided information. However, unknown read vulnerabilities can potentially lead to information disclosure or other security issues.
To fix this vulnerability, update the ghostscript package to a version that includes the fix. The fix is available in version 4affbf8fe0e5982058c498a33689cc5182eab0ed or later.
No specific workaround is mentioned in the provided information. It is recommended to update the package to the latest version.
For more information about this vulnerability, you can refer to the OSS-Fuzz report: [link to the report]
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
