UNKNOWN WRITE vulnerability in ghostscript
Summary
OSV-2022-1229: UNKNOWN WRITE in gdev_mem_open_scan_lines_interleaved. Affects ghostscript versions >= e1cb0035e6d393d827988e2fe3cd6d4d7a04e936, < ba9672456064ecc4166c6293bc36a1b126f3421a. Fixed in ba9672456064ecc4166c6293bc36a1b126f3421a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability in question affects the 'gdev_mem_open_scan_lines_interleaved' function within Ghostscript. This function is responsible for opening scan lines in an interleaved manner. The vulnerability allows for an unknown write operation, which can lead to a crash or potentially be exploited by an attacker.
Vulnerability Detail
The vulnerability arises from an unknown write operation in the 'gdev_mem_open_scan_lines_interleaved' function of Ghostscript. When triggered, this vulnerability can result in a crash. The exact cause and impact of the vulnerability are not specified in the provided information. However, it is classified as a high severity vulnerability. The vulnerability was discovered through an OSS-Fuzz report, and further details can be found in the provided link. The vulnerability affects versions of Ghostscript introduced in commit 'e1cb0035e6d393d827988e2fe3cd6d4d7a04e936' and is fixed in commit 'ba9672456064ecc4166c6293bc36a1b126f3421a'.
How To Fix
Minimum fixed version
ba9672456064ecc4166c6293bc36a1b126f3421a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information.
Conclusion
In conclusion, the UNKNOWN WRITE vulnerability in Ghostscript can lead to crashes or potential exploitation. It is important to update to a fixed version of Ghostscript to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact of this vulnerability is not specified in the provided information. However, it is classified as a high severity vulnerability, indicating potential risks to the stability and security of the affected system.
This vulnerability was discovered through an OSS-Fuzz report. Further details can be found in the provided link.
Versions of Ghostscript introduced in commit 'e1cb0035e6d393d827988e2fe3cd6d4d7a04e936' and earlier are affected by this vulnerability.
To fix this vulnerability, update Ghostscript to a version that includes the fix commit 'ba9672456064ecc4166c6293bc36a1b126f3421a' or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
