Vulnerability in ghostscript: UNKNOWN READ in mem_planar_put_image_slow
Summary
OSV-2024-403: UNKNOWN READ in mem_planar_put_image_slow. Affects ghostscript versions >= d0d127c25192aff5b73c4f55b3f3c4811d6fcbc7, < b7a72058caea441b700dce3e470c503b54d6262c. Fixed in b7a72058caea441b700dce3e470c503b54d6262c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing PDF documents. The vulnerability affects the mem_planar_put_image_slow function in Ghostscript, which is responsible for handling image data. This vulnerability allows for an unknown read operation, potentially leading to unauthorized access to sensitive information or a denial of service.
Vulnerability Detail
The vulnerability originates from the mem_planar_put_image_slow function in Ghostscript. It can be triggered when processing certain PDF files containing maliciously crafted image data. An attacker could exploit this vulnerability to read arbitrary memory, potentially accessing sensitive information. Additionally, this vulnerability may cause the application to crash, resulting in a denial of service. The exact impact and potential ramifications of this vulnerability depend on the specific usage scenario and the data being processed.
How To Fix
Minimum fixed version
b7a72058caea441b700dce3e470c503b54d6262c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no known workarounds exist for this vulnerability. It is crucial to update to a patched version of Ghostscript as soon as possible.
Conclusion
The vulnerability in Ghostscript, known as UNKNOWN READ in mem_planar_put_image_slow, poses a risk of unauthorized access to sensitive information or a denial of service. It is recommended to update to a patched version of Ghostscript that includes the necessary fixes. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and processing PDF documents.
This vulnerability allows for unauthorized access to sensitive information or a denial of service. The exact impact depends on the specific usage scenario and the data being processed.
The vulnerability was introduced in Ghostscript starting from the commit d0d127c25192aff5b73c4f55b3f3c4811d6fcbc7. Users should ensure they are using a version that includes this commit or a subsequent release with the fix.
No known workarounds exist for this vulnerability. It is crucial to update to a patched version of Ghostscript.
You can find more information about this vulnerability in the OSS-Fuzz report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
