Heap-buffer-overflow in Interp in ghostscript
Summary
OSV-2022-522: Heap-buffer-overflow in Interp. Affects ghostscript versions >= 441c9e3a4ca08fa7f7c00063af33196b0d88ebaf, < e950d1fa30cda37cae4cc0553a4d24135fc09695. Fixed in e950d1fa30cda37cae4cc0553a4d24135fc09695. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question is a heap-buffer-overflow in the Interp component of Ghostscript.
Vulnerability Detail
The vulnerability is a heap-buffer-overflow that can be triggered during the execution of certain instructions in the Interp module of Ghostscript. This can lead to a crash or potentially allow an attacker to execute arbitrary code. The issue was reported through the OSS-Fuzz project and has been assigned a medium severity level. More details can be found in the OSS-Fuzz report: OSS-Fuzz Report
How To Fix
Minimum fixed version
e950d1fa30cda37cae4cc0553a4d24135fc09695
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update Ghostscript to a fixed version as soon as possible.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been identified in the Interp module of Ghostscript. This vulnerability can lead to a crash or potential code execution. It is crucial to update Ghostscript to a fixed version to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability can lead to a crash or potentially allow an attacker to execute arbitrary code.
This vulnerability was reported through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
This vulnerability has been assigned a medium severity level.
Yes, the fix for this vulnerability is available in a later version of Ghostscript. It is recommended to update to a version that includes the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
