UNKNOWN READ Vulnerability in Ghostscript: Memory Management Flaw
Summary
OSV-2024-1042: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= bf0048d271aa6a4d9898997ada84cf89c197e791, < 0b894a24043aca1d62a149fd2e3100d3a46a53b2. Fixed in 0b894a24043aca1d62a149fd2e3100d3a46a53b2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is known for its robust capabilities in handling graphics and text, making it essential for applications that require document manipulation. However, like many complex software systems, Ghostscript is susceptible to vulnerabilities that can lead to security risks, particularly in memory management.
Vulnerability Detail
The vulnerability identified as OSV-2024-1042 is characterized by an UNKNOWN READ error in the chunk_free_object function. This issue was reported through OSS-Fuzz, indicating a potential flaw in memory handling that could lead to crashes or unexpected behavior. The crash state reveals that the vulnerability occurs during the finalization of a stream, which suggests that improper memory access could be exploited, potentially leading to denial of service or other security implications.
How To Fix
Minimum fixed version
0b894a24043aca1d62a149fd2e3100d3a46a53b2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using features that trigger the chunk_free_object function until the update is applied. However, the best course of action is to apply the fix as soon as possible to mitigate any risks associated with this vulnerability.
Conclusion
The UNKNOWN READ vulnerability in Ghostscript poses a significant risk due to its potential to disrupt application functionality through improper memory management. Users are strongly advised to update to the latest version to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for ghostscript →
FAQ
The UNKNOWN READ vulnerability involves improper memory access during the execution of Ghostscript, which can lead to crashes or unexpected behavior.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could lead to denial of service, application crashes, or other security issues, depending on how the affected functions are used.
Yes, you should upgrade to the version that includes the fix, specifically the commit 0b894a24043aca1d62a149fd2e3100d3a46a53b2.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It helps ensure your applications remain secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
