Global-buffer-overflow in chunk_obj_alloc in ghostscript
Summary
OSV-2022-755: Global-buffer-overflow in chunk_obj_alloc. Affects ghostscript versions >= 3eb1eeac22f53b8b332e67d8ba18540f4020eadc, < 1d8d9605e251d1b51281efe5ef8db07640e49203. Fixed in 1d8d9605e251d1b51281efe5ef8db07640e49203. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents. The vulnerability in question, identified as OSV-2022-755, affects the chunk_obj_alloc function in Ghostscript. This function is responsible for allocating memory for objects in the Ghostscript interpreter. The vulnerability allows for a global buffer overflow, which can lead to a read of 8 bytes beyond the bounds of the allocated buffer. This vulnerability was discovered through the OSS-Fuzz project.
Vulnerability Detail
The global buffer overflow in chunk_obj_alloc can be exploited by an attacker to read 8 bytes beyond the bounds of the allocated buffer. This can potentially lead to information disclosure or even remote code execution. The vulnerability is triggered during the allocation of byte arrays in the zlib compression library used by Ghostscript. By crafting a malicious input, an attacker can trigger the buffer overflow and potentially exploit it to gain unauthorized access or perform other malicious actions.
How To Fix
Minimum fixed version
1d8d9605e251d1b51281efe5ef8db07640e49203
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider disabling the use of the zlib compression library in Ghostscript. This can be achieved by modifying the Ghostscript configuration or build options to exclude zlib support. However, this workaround may impact the functionality or performance of certain features that rely on zlib compression.
Conclusion
The global-buffer-overflow vulnerability in chunk_obj_alloc in Ghostscript can potentially lead to information disclosure or remote code execution. It is crucial for users to update their installations to a version that includes the fix. As a temporary workaround, disabling zlib compression can be considered, but updating to a fixed version is the recommended solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability can potentially lead to information disclosure or remote code execution, depending on how it is exploited.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will analyze your dependencies for known vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate the risk.
Yes, a patch has been released to address this vulnerability. Users should update their installations to a version that includes the fix.
As a temporary workaround, you can consider disabling the use of the zlib compression library in Ghostscript. However, it is recommended to update to a fixed version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
