UNKNOWN READ vulnerability in ghostscript
Summary
OSV-2024-496: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= bf0048d271aa6a4d9898997ada84cf89c197e791, < fdf933dadd618afb53e78a86f115b48decc2ab64. Fixed in fdf933dadd618afb53e78a86f115b48decc2ab64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question allows for an UNKNOWN READ operation, which can lead to unexpected behavior and potential security risks.
Vulnerability Detail
The vulnerability originates from the chunk_free_object function in Ghostscript. When this function is called, an UNKNOWN READ operation occurs, resulting in a crash. The crash state includes the functions chunk_free_object, gs_memory_chunk_unwrap, and gs_j_mem_term. The impact of this vulnerability can vary depending on the specific usage of Ghostscript, but it has the potential to lead to data corruption, denial of service, or even remote code execution.
How To Fix
Minimum fixed version
fdf933dadd618afb53e78a86f115b48decc2ab64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is crucial to update Ghostscript to a patched version as soon as possible.
Conclusion
The UNKNOWN READ vulnerability in Ghostscript can have serious consequences, including data corruption and potential remote code execution. It is crucial to update Ghostscript to a patched version as soon as possible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact can vary depending on the specific usage of Ghostscript, but it has the potential to lead to data corruption, denial of service, or even remote code execution.
No, there is currently no known workaround for this vulnerability. It is crucial to update Ghostscript to a patched version.
To fix this vulnerability, it is recommended to update Ghostscript to a version that includes the necessary patches. Follow the official recommendations from the Ghostscript development team.
You can find more information about this vulnerability in the OSS-Fuzz report linked in the details section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
