Stack-buffer-underflow in gs_type2_interpret in ghostscript
Summary
OSV-2022-1148: Stack-buffer-underflow in gs_type2_interpret. Affects ghostscript versions >= 441c9e3a4ca08fa7f7c00063af33196b0d88ebaf, < 519ca4efe92bd16f850cd32ac783c1015191230c. Fixed in 519ca4efe92bd16f850cd32ac783c1015191230c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PostScript and PDF files. The vulnerability in question, identified as OSV-2022-1148, is a stack-buffer-underflow issue that affects the gs_type2_interpret function in Ghostscript. This vulnerability can potentially lead to a crash or arbitrary code execution.
Vulnerability Detail
The stack-buffer-underflow vulnerability occurs when the gs_type2_interpret function reads 4 bytes beyond the bounds of a stack buffer. This can result in the corruption of adjacent memory and potentially lead to a crash or the execution of malicious code. The vulnerability was discovered through an OSS-Fuzz report and has been assigned the identifier OSV-2022-1148. It is important to note that this vulnerability affects the Ghostscript package.
How To Fix
Minimum fixed version
519ca4efe92bd16f850cd32ac783c1015191230c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to exercise caution when processing untrusted PostScript or PDF files using Ghostscript. Avoid opening files from untrusted sources or ensure that they are thoroughly inspected for potential malicious content before processing them with Ghostscript.
Conclusion
In conclusion, the stack-buffer-underflow vulnerability in the gs_type2_interpret function of Ghostscript can lead to crashes or the execution of arbitrary code. It is crucial to update the Ghostscript package to a fixed version and exercise caution when handling untrusted files. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PostScript and PDF files.
A stack-buffer-underflow vulnerability occurs when a program reads data beyond the bounds of a stack buffer, potentially leading to memory corruption and crashes or the execution of malicious code.
This vulnerability was discovered through an OSS-Fuzz report, which is a continuous fuzzing service for open-source software. The report identified the stack-buffer-underflow issue in the gs_type2_interpret function of Ghostscript.
The stack-buffer-underflow vulnerability in Ghostscript can potentially result in crashes or the execution of arbitrary code. This could be exploited by an attacker to gain unauthorized access or perform other malicious activities.
To mitigate this vulnerability, it is recommended to update the Ghostscript package to a version that includes the fix. Additionally, exercise caution when processing untrusted PostScript or PDF files using Ghostscript.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
