UNKNOWN READ vulnerability in ghostscript: pdf14_buf_free
Summary
OSV-2022-271: UNKNOWN READ in pdf14_buf_free. Affects ghostscript across 2 version ranges.
< a4b71ab352e9e9b3f849b3727944b6e8ec64e7b0
>= efab3239bc4a02827cafbc89149bb8d982ee8a8e, < dc67c64d6d61f5fa9b065c03cabd237d67158802
Fixed in dc67c64d6d61f5fa9b065c03cabd237d67158802. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating PDF files. The vulnerability in question affects the pdf14_buf_free function in Ghostscript, which is responsible for freeing memory buffers used during PDF processing.
Vulnerability Detail
The vulnerability is categorized as an UNKNOWN READ issue. It was discovered through an OSS-Fuzz report, which provided a crash state indicating the affected functions. The specific impact and potential ramifications of this vulnerability are not explicitly mentioned in the provided information.
How To Fix
Minimum fixed version
dc67c64d6d61f5fa9b065c03cabd237d67158802
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in Ghostscript's pdf14_buf_free function has been identified. To mitigate this vulnerability, it is recommended to update the Ghostscript package to a version that includes the fix. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating PDF files.
The provided information does not explicitly mention the impact of this vulnerability.
To fix this vulnerability, update the Ghostscript package to a version that includes the fix.
No specific workarounds are mentioned in the provided information.
For more information about this vulnerability, you can refer to the OSS-Fuzz report linked in the provided information.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
