UNKNOWN READ vulnerability in ghostscript
Summary
OSV-2024-1041: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= 2422afa72801603247b6a748ea32ca2ce9443ecd, < 1ac1eccea312dae6830cff0769d88b75e87ae164. Fixed in 1ac1eccea312dae6830cff0769d88b75e87ae164. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question affects the chunk_free_object function within Ghostscript. This function is responsible for freeing memory chunks, and the vulnerability allows for an unknown read operation. This vulnerability has a medium severity rating.
Vulnerability Detail
The vulnerability originates from an unknown read operation in the chunk_free_object function. It can potentially lead to crashes or other undefined behavior. The specific crash state observed is chunk_free_object -> sfclose -> pdfi_close_file. Further technical details can be found in the OSS-Fuzz report linked below.
How To Fix
Minimum fixed version
1ac1eccea312dae6830cff0769d88b75e87ae164
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The UNKNOWN READ vulnerability in Ghostscript's chunk_free_object function can lead to crashes or other undefined behavior. It is recommended to update to the fixed version to mitigate this vulnerability.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact of this vulnerability can vary, but it has the potential to cause crashes or other undefined behavior in applications that utilize Ghostscript.
To fix this vulnerability, it is recommended to update Ghostscript to the fixed version, which is commit 1ac1eccea312dae6830cff0769d88b75e87ae164 in the Git repository.
No specific workaround has been provided for this vulnerability.
More technical details can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
