Segv on unknown address in gx_device_finalize in ghostscript
Summary
OSV-2022-453: Segv on unknown address in gx_device_finalize. Affects ghostscript versions >= e4fef6cf2181283849322c244b953d8c1d42ca4d, < 6ae825b8a85f93917b07cef1f4b2d6951f4b07cf. Fixed in 6ae825b8a85f93917b07cef1f4b2d6951f4b07cf. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, identified as OSV-2022-453, affects the ghostscript package. Ghostscript's gx_device_finalize function encounters a segmentation fault (Segv) on an unknown address during its execution. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability manifests as a segmentation fault (Segv) on an unknown address within the gx_device_finalize function of ghostscript. The crash state includes the following stack trace: gx_device_finalize, alloc_restore_step_in, dorestore. The exact cause and impact of this vulnerability are not explicitly mentioned in the provided information. However, it is crucial to note that a segmentation fault can lead to program crashes, denial of service, or even potential remote code execution if exploited by an attacker.
How To Fix
Minimum fixed version
6ae825b8a85f93917b07cef1f4b2d6951f4b07cf
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability OSV-2022-453 in ghostscript's gx_device_finalize function can lead to a segmentation fault and potential program crashes. It is recommended to update to a version of ghostscript that includes the fix for this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact of this vulnerability is not explicitly mentioned in the provided information. However, a segmentation fault can lead to program crashes, denial of service, or potential remote code execution if exploited.
To fix this vulnerability, it is recommended to update to a version of ghostscript that includes the fix for this issue. The fix can be found in commit 6ae825b8a85f93917b07cef1f4b2d6951f4b07cf of the ghostpdl.git repository.
No specific workaround has been mentioned for this vulnerability.
More information about this vulnerability can be found in the OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47770
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
