UNKNOWN READ Vulnerability in ghostscript
Summary
OSV-2021-1788: UNKNOWN READ in pdfi_free_object. Affects ghostscript versions >= 31e249d5cbd561d76dd2149ceee5fe3a2d84d658, < 067d47b5efa3631ac58a62916136ad21cd9017df. Fixed in 067d47b5efa3631ac58a62916136ad21cd9017df. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. This vulnerability affects the ghostscript package and can lead to an UNKNOWN READ crash. The vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability occurs in the pdfi_free_object function of ghostscript. It can be triggered when processing certain PDF files, leading to an UNKNOWN READ crash. The crash state includes calls to pdfi_create_colorspace_by_array and pdfi_create_DeviceN. The exact cause and impact of the vulnerability are not specified in the provided information.
How To Fix
Minimum fixed version
067d47b5efa3631ac58a62916136ad21cd9017df
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in ghostscript can lead to crashes when processing certain PDF files. It is recommended to update to a fixed version of the ghostscript package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The impact of this vulnerability is not specified in the provided information. It is recommended to update to a fixed version to mitigate any potential risks.
To fix this vulnerability, update the ghostscript package to a version that includes the fix. The fix was implemented in commit 067d47b5efa3631ac58a62916136ad21cd9017df in the ghostpdl.git repository.
No specific workaround is mentioned in the provided information.
More information about this vulnerability can be found in the OSS-Fuzz report: [link to the report]
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
