Stack-buffer-overflow in gs_type2_interpret in ghostscript
Summary
OSV-2022-888: Stack-buffer-overflow in gs_type2_interpret. Affects ghostscript versions >= 7409743d98cab135da537bce11103a8416d77f60, < 893e67b7b7253aa147740269525b2a071c7bbe79. Fixed in 893e67b7b7253aa147740269525b2a071c7bbe79. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question, identified as OSV-2022-888, is a stack-buffer-overflow in the function gs_type2_interpret. This vulnerability was reported through the OSS-Fuzz project and affects the Ghostscript package.
Vulnerability Detail
The stack-buffer-overflow vulnerability in gs_type2_interpret can lead to a crash due to a read of 4 bytes beyond the bounds of a buffer. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in commit 7409743d98cab135da537bce11103a8416d77f60 and fixed in commit 893e67b7b7253aa147740269525b2a071c7bbe79.
How To Fix
Minimum fixed version
893e67b7b7253aa147740269525b2a071c7bbe79
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider avoiding the use of the affected function or limiting its usage to trusted inputs. However, applying the official fix is the recommended approach to ensure the complete resolution of the vulnerability.
Conclusion
In conclusion, the vulnerability OSV-2022-888 in Ghostscript's gs_type2_interpret function can lead to a stack-buffer-overflow, potentially enabling arbitrary code execution or denial-of-service attacks. It is crucial to update the Ghostscript package to a fixed version or apply the recommended workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on various open-source software.
To fix this vulnerability, it is recommended to update the Ghostscript package to a version that includes the fix commit or a later version.
A workaround is to avoid using the affected function or limit its usage to trusted inputs. However, applying the official fix is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
