UNKNOWN READ vulnerability in ghostscript: pdfi_count_cff_index
Summary
OSV-2021-1802: UNKNOWN READ in pdfi_count_cff_index. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < 3536cb075b8d7a3cd2bbe62e8ef879f56be60700. Fixed in 3536cb075b8d7a3cd2bbe62e8ef879f56be60700. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PostScript and PDF files. The vulnerability in question affects the handling of CFF (Compact Font Format) fonts in Ghostscript. CFF fonts are a compact representation of OpenType fonts and are commonly used in PDF files. This vulnerability allows for an unknown read access, which could potentially lead to information disclosure or other security issues.
Vulnerability Detail
The vulnerability arises in the pdfi_count_cff_index function of Ghostscript. When processing a CFF font, an unknown read access occurs, leading to a crash. The exact cause and impact of this read access are not specified in the provided information. However, it is important to note that unknown read vulnerabilities can potentially expose sensitive data or be leveraged to execute arbitrary code. The vulnerability has been assigned a medium severity level.
How To Fix
Minimum fixed version
3536cb075b8d7a3cd2bbe62e8ef879f56be60700
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned in the provided information. However, users can consider implementing general security best practices such as restricting access to vulnerable systems, applying network-level controls, and monitoring for any suspicious activity.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in Ghostscript's pdfi_count_cff_index function poses a potential risk of information disclosure or other security issues. Users are advised to update their installations to a version that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PostScript and PDF files.
CFF (Compact Font Format) is a compact representation of OpenType fonts. It is commonly used in PDF files.
An unknown read vulnerability refers to a situation where an application attempts to read data from an unknown or unexpected location in memory. This can potentially lead to information disclosure or other security issues.
The exact impact of this vulnerability is not specified in the provided information. However, it is important to note that unknown read vulnerabilities can potentially expose sensitive data or be leveraged to execute arbitrary code.
This vulnerability has been assigned a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
