Segv on unknown address in chunk_free_object in ghostscript
Summary
OSV-2022-523: Segv on unknown address in chunk_free_object. Affects ghostscript versions >= 441c9e3a4ca08fa7f7c00063af33196b0d88ebaf, < e950d1fa30cda37cae4cc0553a4d24135fc09695. Fixed in e950d1fa30cda37cae4cc0553a4d24135fc09695. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents in various applications. The vulnerability in question, identified as OSV-2022-523, affects the ghostscript package. Ghostscript is susceptible to a segmentation fault (segv) error when attempting to free an object at an unknown address. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability occurs in the chunk_free_object function of ghostscript's memory management. When attempting to free an object, the function encounters an unknown address, leading to a segmentation fault. This issue can potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code. The crash state indicates that the issue is triggered during the destruction of a context.
How To Fix
Minimum fixed version
e950d1fa30cda37cae4cc0553a4d24135fc09695
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerability by refraining from performing actions that involve the destruction of a context in ghostscript. However, this workaround may not be feasible in all scenarios and it is strongly advised to apply the official fix by updating the package.
Conclusion
The vulnerability in ghostscript, identified as OSV-2022-523, can result in a segmentation fault during the destruction of a context. This issue can have severe consequences, including denial-of-service and arbitrary code execution. It is crucial to update the ghostscript package to a version containing the fix (commit e950d1fa30cda37cae4cc0553a4d24135fc09695). Applying the official fix is strongly recommended to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents in various applications.
The vulnerability can lead to a segmentation fault, potentially causing a denial-of-service (DoS) condition or enabling arbitrary code execution.
To fix this vulnerability, update the ghostscript package to a version that includes the fix. The specific commit addressing this issue is e950d1fa30cda37cae4cc0553a4d24135fc09695.
A workaround is to avoid actions that involve the destruction of a context in ghostscript. However, it is recommended to apply the official fix by updating the package.
You can find more information about this vulnerability in the OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48528
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.