UNKNOWN READ Vulnerability in ghostscript
Summary
OSV-2021-1774: UNKNOWN READ in pdfi_array_get. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 20face1eeb418935307731d4e2e4bada028c7ba7. Fixed in 20face1eeb418935307731d4e2e4bada028c7ba7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability in question affects the ghostscript package and can lead to an UNKNOWN READ crash. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability arises from an UNKNOWN READ operation in the pdfi_array_get function of ghostscript. It can be triggered by a specific input, causing a crash in the pdfi_array_get_type and pdfi_create_colorspace_by_array functions. The exact impact and potential ramifications of this vulnerability are not explicitly mentioned in the provided information.
How To Fix
Minimum fixed version
20face1eeb418935307731d4e2e4bada028c7ba7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in ghostscript can lead to a crash in certain functions. It is recommended to update the ghostscript package to a fixed version to mitigate any potential risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The exact impact of this vulnerability is not specified in the provided information. It is advisable to update the package to a fixed version as a precautionary measure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. It requires no signup and uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
The provided information does not mention any known exploits for this vulnerability. However, it is always recommended to promptly update to a fixed version to mitigate potential risks.
The provided information does not mention any CVE assigned to this vulnerability. It is advisable to refer to the official documentation or security advisories for the ghostscript package for more information.
You can find more details about this vulnerability in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43004.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
