Stack-buffer-overflow in fn_ElIn_evaluate in ghostscript
Summary
OSV-2023-285: Stack-buffer-overflow in fn_ElIn_evaluate. Affects ghostscript versions >= f20fac9d4d505be579ca4c5872233b3ec2d85f85, < 7eced55b5700c0d2aa2e102ed78f10b0ce755a64. Fixed in 7eced55b5700c0d2aa2e102ed78f10b0ce755a64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability in question, identified as OSV-2023-285, is a stack-buffer-overflow in the function fn_ElIn_evaluate. This vulnerability was reported through the OSS-Fuzz project and affects the ghostscript package.
Vulnerability Detail
The stack-buffer-overflow vulnerability occurs when writing more data than the buffer can hold, potentially leading to memory corruption and arbitrary code execution. In this case, the vulnerability is triggered in the fn_ElIn_evaluate function, which is part of the ghostscript package. The specific crash state involves pdfi_set_blackgeneration and GS_BG. The severity of this vulnerability is classified as HIGH.
How To Fix
Minimum fixed version
7eced55b5700c0d2aa2e102ed78f10b0ce755a64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above as soon as possible.
Conclusion
In conclusion, the stack-buffer-overflow vulnerability in fn_ElIn_evaluate of the ghostscript package poses a significant risk of memory corruption and arbitrary code execution. It is crucial to update to a version that includes the fix or any subsequent version to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The stack-buffer-overflow vulnerability in fn_ElIn_evaluate can potentially lead to memory corruption and arbitrary code execution. This could be exploited by an attacker to gain unauthorized access or perform other malicious actions.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzzing on various open-source projects to identify potential vulnerabilities.
The severity of this vulnerability is classified as HIGH.
At the moment, there is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
