Vulnerability in ghostscript: UNKNOWN READ in s_RLE_process
Summary
OSV-2022-278: UNKNOWN READ in s_RLE_process. Affects ghostscript across 2 version ranges.
< 74fcdb4671a45bc2f4b8803b58640661e2b3a615
>= 75fbddf52051987287e62d13c659eb73ba16982f, < 38b3bde1293ea8b6064bd6c2a1ed60171adea82b
Fixed in 38b3bde1293ea8b6064bd6c2a1ed60171adea82b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents. The vulnerability identified in ghostscript is an UNKNOWN READ issue in the s_RLE_process function. This vulnerability was reported through the OSS-Fuzz project and affects versions of ghostscript prior to the fixed versions.
Vulnerability Detail
The UNKNOWN READ vulnerability in ghostscript's s_RLE_process function can lead to a crash. The exact cause and impact of this vulnerability are not specified in the provided information. However, it is important to note that crashes can potentially be exploited by attackers to achieve arbitrary code execution or denial of service. The vulnerability has been assigned a medium severity level.
How To Fix
Minimum fixed version
38b3bde1293ea8b6064bd6c2a1ed60171adea82b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround information is provided for this vulnerability.
Conclusion
In conclusion, the vulnerability in ghostscript's s_RLE_process function can lead to crashes and potentially be exploited by attackers. It is recommended to update ghostscript to the fixed versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and processing documents.
The impact of this vulnerability is not specified in the provided information. However, crashes can potentially be exploited by attackers to achieve arbitrary code execution or denial of service.
To fix this vulnerability, update ghostscript to the fixed versions mentioned in the 'how_to_fix' section.
No workaround information is provided for this vulnerability.
For more information, you can refer to the provided source link in the 'database_specific' section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
