Negative-size-param in general_endcidrange_func in ghostscript
Summary
OSV-2021-1795: Negative-size-param in general_endcidrange_func. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < f7dc952613f4e614fae5fe859a5b6a90e3e17bf7. Fixed in f7dc952613f4e614fae5fe859a5b6a90e3e17bf7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an interpreter for the PostScript language and for PDF files. It is widely used for rendering and converting documents in various formats. The general_endcidrange_func function in Ghostscript is responsible for handling CID ranges in CMap files. This vulnerability allows an attacker to trigger a negative size parameter, leading to a crash in the general_endcidrange_func function.
Vulnerability Detail
The negative-size-param vulnerability in Ghostscript can be exploited by providing a specially crafted CMap file. When this file is processed, the general_endcidrange_func function is called with a negative size parameter. This triggers a crash in the function, potentially leading to a denial-of-service condition. The vulnerability was discovered through the OSS-Fuzz project and has been assigned the identifier OSV-2021-1795. It affects versions of Ghostscript up to and including commit 75fbddf52051987287e62d13c659eb73ba16982f, and has been fixed in commit f7dc952613f4e614fae5fe859a5b6a90e3e17bf7.
How To Fix
Minimum fixed version
f7dc952613f4e614fae5fe859a5b6a90e3e17bf7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
The negative-size-param vulnerability in Ghostscript can be exploited by providing a specially crafted CMap file, leading to a crash in the general_endcidrange_func function. To mitigate this vulnerability, it is recommended to update Ghostscript to a version that includes the fix commit f7dc952613f4e614fae5fe859a5b6a90e3e17bf7 or later. Regularly updating software dependencies is also advised to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an interpreter for the PostScript language and for PDF files. It is commonly used for rendering and converting documents in various formats.
A CMap file is a mapping file used by Ghostscript to associate character codes with glyph descriptions in a font.
An attacker can exploit this vulnerability by providing a specially crafted CMap file that triggers a negative size parameter in the general_endcidrange_func function.
This vulnerability can lead to a crash in Ghostscript, potentially causing a denial-of-service condition.
Yes, this vulnerability has been fixed in Ghostscript commit f7dc952613f4e614fae5fe859a5b6a90e3e17bf7 and later versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
