Heap-buffer-overflow in Ins_NPUSHW in ghostscript
Summary
OSV-2022-818: Heap-buffer-overflow in Ins_NPUSHW. Affects ghostscript across 2 version ranges.
>= cf5e0668ddedadb0496587103dadfc9b1c90b3e9, < 00897ae3a48a4f36b84fe61a1e3aa6252bf418e5
< de3e7e6f29303e121599d413b97763946e2f39df
Fixed in 00897ae3a48a4f36b84fe61a1e3aa6252bf418e5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, identified as OSV-2022-818, is a heap-buffer-overflow issue that affects the Ins_NPUSHW function in Ghostscript. This function is responsible for pushing a sequence of 16-bit integers onto the operand stack. The vulnerability can be triggered by a specially crafted PostScript or PDF file, potentially leading to a crash or arbitrary code execution.
Vulnerability Detail
The heap-buffer-overflow vulnerability in Ins_NPUSHW arises due to a read overflow of 1 byte. This can occur when the function attempts to read more data from the input than is available in the buffer, resulting in accessing memory beyond its boundaries. An attacker could exploit this vulnerability by crafting a malicious PostScript or PDF file that triggers the overflow, potentially leading to remote code execution or denial of service. The vulnerability has been assigned a medium severity level.
How To Fix
Minimum fixed version
00897ae3a48a4f36b84fe61a1e3aa6252bf418e5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider disabling the processing of untrusted PostScript or PDF files in Ghostscript. This can be achieved by configuring the application to only process files from trusted sources or by implementing a file validation mechanism to ensure the integrity of the files being processed.
Conclusion
In conclusion, the Ins_NPUSHW function in Ghostscript is vulnerable to a heap-buffer-overflow issue that can be triggered by specially crafted PostScript or PDF files. It is crucial to update the Ghostscript package to a fixed version or apply the recommended workaround to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting a heap-buffer-overflow issue in Ghostscript.
To fix this vulnerability, it is recommended to update the Ghostscript package to a version that includes the fix. Details of the fixed versions can be found in the 'how_to_fix' section.
Yes, as a temporary workaround, users can consider disabling the processing of untrusted PostScript or PDF files in Ghostscript. More information can be found in the 'workaround' section.
The vulnerability has been assigned a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
