UNKNOWN WRITE vulnerability in ghostscript: alloc_restore_step_in
Summary
OSV-2022-449: UNKNOWN WRITE in alloc_restore_step_in. Affects ghostscript versions >= 036510cb897990077f95d9e05ba3daac19bce77e, < 0d32d5a9aea919e9ab4c0431027f5ec47ccc4a64. Fixed in 0d32d5a9aea919e9ab4c0431027f5ec47ccc4a64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating documents in various applications. The vulnerability in question, alloc_restore_step_in, affects the Ghostscript package and can lead to a crash due to an unknown write operation. This vulnerability was discovered through the OSS-Fuzz project.
Vulnerability Detail
The UNKNOWN WRITE vulnerability in alloc_restore_step_in function of Ghostscript can result in a crash. The exact cause and impact of this vulnerability are not specified in the provided information. However, it is important to note that crashes can potentially lead to denial of service (DoS) situations and may also be exploitable for remote code execution (RCE) attacks. Further technical details can be found in the provided OSS-Fuzz report.
How To Fix
Minimum fixed version
0d32d5a9aea919e9ab4c0431027f5ec47ccc4a64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. However, it is generally advisable to keep software and libraries up to date with the latest security patches to mitigate the risk of known vulnerabilities.
Conclusion
The UNKNOWN WRITE vulnerability in the alloc_restore_step_in function of Ghostscript can lead to crashes and potentially have security implications. It is recommended to update the Ghostscript package to a version that includes the fix for this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating documents.
The impact of this vulnerability is not specified in the provided information. However, crashes can potentially lead to denial of service (DoS) situations and may also be exploitable for remote code execution (RCE) attacks.
To fix this vulnerability, it is recommended to update the Ghostscript package to a version that includes the fix. The fix can be found in commit 0d32d5a9aea919e9ab4c0431027f5ec47ccc4a64 of the Ghostscript Git repository.
No specific workaround is mentioned in the provided information. However, keeping software and libraries up to date with the latest security patches can help mitigate the risk of known vulnerabilities.
More information about this vulnerability can be found in the provided OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47753
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
