Critical UNKNOWN READ Vulnerability in Ghostscript
Summary
OSV-2024-1059: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= 87db48b2fc8297a4537907c425a1eda19239888c, < f7e3c5b8dea9ef70efd17559d4a506810a5847fd. Fixed in f7e3c5b8dea9ef70efd17559d4a506810a5847fd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is known for its powerful capabilities in handling graphics and text, making it a popular choice among developers and organizations for document manipulation. However, like many software packages, it is susceptible to vulnerabilities that can compromise its integrity and security.
Vulnerability Detail
The vulnerability identified as OSV-2024-1059 is characterized by an UNKNOWN READ in the chunk_free_object function. This issue was reported through OSS-Fuzz, a service that helps find vulnerabilities in open-source software. The crash state indicates that the vulnerability can lead to unexpected behavior or crashes when handling file operations, specifically during the closing of files. If exploited, this vulnerability could allow an attacker to manipulate memory, potentially leading to arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
f7e3c5b8dea9ef70efd17559d4a506810a5847fd
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionalities that trigger the UNKNOWN READ crash until they can apply the patch. It is advisable to monitor the application closely for any unusual behavior during file operations.
Conclusion
The UNKNOWN READ vulnerability in Ghostscript poses a significant risk that can lead to application crashes and potential exploitation. It is crucial for users to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for ghostscript →
FAQ
The UNKNOWN READ vulnerability allows for unexpected memory access, which can lead to application crashes or potential exploitation.
You can check your version of Ghostscript by running gs --version in your terminal. If it falls between the introduced and fixed commits, it is affected.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider implementing the suggested workaround and closely monitor your application for any irregularities.
Detailed information about this vulnerability can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
