UNKNOWN READ vulnerability in ghostscript
Summary
OSV-2022-1214: UNKNOWN READ in chunk_free_object. Affects ghostscript versions >= efafa5e9761102fa8190f5bc48231aa3d366b6d9, < 141e7c28b223d2ad822a4c1fb5acdbf9501e67dd. Fixed in 141e7c28b223d2ad822a4c1fb5acdbf9501e67dd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. This vulnerability affects the ghostscript package and can lead to an UNKNOWN READ crash. Ghostscript is vulnerable to this issue due to a flaw in the chunk_free_object function. Attackers may exploit this vulnerability to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability originates from a flaw in the chunk_free_object function of ghostscript. When processing certain input, an UNKNOWN READ crash can occur. This can be triggered by an attacker, potentially leading to the execution of arbitrary code or a denial of service. The crash state indicates that the issue occurs during the finalization of a DeviceN object in the gs_cspace_final function.
How To Fix
Minimum fixed version
141e7c28b223d2ad822a4c1fb5acdbf9501e67dd
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is crucial to update to the patched version of ghostscript to mitigate the risk.
Conclusion
The UNKNOWN READ vulnerability in ghostscript can lead to arbitrary code execution or a denial of service. It is crucial to update to the patched version of ghostscript (9.55.0 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability can be exploited by attackers to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update the ghostscript package to version 9.55.0 or later.
No, there is currently no known workaround for this vulnerability.
You can find more information about this vulnerability in the OSS-Fuzz report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
