UNKNOWN READ in ref_stack_counttomark in ghostscript
Summary
OSV-2022-351: UNKNOWN READ in ref_stack_counttomark. Affects ghostscript versions >= 45e765e59a45b46dcb05e8c729689a7c0574a48c, < d9c9ce0bf43b17770ff826261d5fed835a29d8ff. Fixed in d9c9ce0bf43b17770ff826261d5fed835a29d8ff. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question affects the ref_stack_counttomark function in Ghostscript, which is responsible for counting the number of objects on the operand stack until the mark object is encountered. This vulnerability can potentially lead to unknown read access, posing a security risk to systems utilizing Ghostscript.
Vulnerability Detail
The vulnerability arises from an unknown read access issue in the ref_stack_counttomark function of Ghostscript. When this function is called, it fails to properly handle certain inputs, resulting in an unknown read access. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information or execute arbitrary code. The impact of this vulnerability can vary depending on the context in which Ghostscript is used, but it has the potential to compromise the confidentiality, integrity, and availability of affected systems.
How To Fix
Minimum fixed version
d9c9ce0bf43b17770ff826261d5fed835a29d8ff
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing access controls and restrictions to limit the potential impact of this vulnerability. Additionally, it is advisable to monitor and restrict network access to Ghostscript instances to minimize the risk of exploitation.
Conclusion
In conclusion, the UNKNOWN READ vulnerability in the ref_stack_counttomark function of Ghostscript poses a security risk to systems utilizing this open-source interpreter. It is crucial to update Ghostscript to a version that includes the fix for this vulnerability to mitigate the potential impact. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability can potentially allow unauthorized access to sensitive information or enable the execution of arbitrary code, compromising the security of affected systems.
To fix this vulnerability, it is recommended to update Ghostscript to a version that includes the fix for this issue. Refer to the provided commit in the Ghostscript repository for the specific fix.
As a temporary workaround, users can implement access controls and restrictions to limit the potential impact of this vulnerability. It is also advisable to restrict network access to Ghostscript instances.
For more information about this vulnerability, refer to the provided OSS-Fuzz report and the source link in the database-specific section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
