Vulnerability in ghostscript: UNKNOWN READ in stream_finalize
Summary
OSV-2022-828: UNKNOWN READ in stream_finalize. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. This vulnerability affects the ghostscript package and has been identified through the OSS-Fuzz project. Ghostscript is susceptible to an UNKNOWN READ vulnerability in the stream_finalize function. This vulnerability could potentially lead to crashes or other unknown consequences.
Vulnerability Detail
The UNKNOWN READ vulnerability in ghostscript's stream_finalize function allows for unauthorized access to memory. An attacker could exploit this vulnerability to read sensitive information or execute arbitrary code. The exact cause and impact of this vulnerability are currently unknown. However, it has been reported that the crash occurs in the stream_finalize function, specifically during the i_free_object and cos_write_stream_alloc operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is advised to follow the recommended fix and update the ghostscript package as soon as an update becomes available.
Conclusion
In conclusion, the ghostscript package is vulnerable to an UNKNOWN READ vulnerability in the stream_finalize function. This vulnerability could potentially lead to unauthorized access to memory and the execution of arbitrary code. It is crucial to update the ghostscript package to the latest version as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The impact of this vulnerability is currently unknown. It could potentially lead to crashes or other unknown consequences.
To fix this vulnerability, update the ghostscript package to the latest version when a patch or update becomes available.
Currently, there is no known workaround for this vulnerability. It is recommended to update the package as soon as possible.
You can find more information about this vulnerability in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
