Heap-buffer-overflow in ghostscript: pdf14_preserve_backdrop
Summary
OSV-2023-142: Heap-buffer-overflow in pdf14_preserve_backdrop. Affects ghostscript versions >= 51516cfda0abb9b27e9571646edf1dcebe6245ba, < f62a3f606db3163b85666a0b8997e52987c87e97. Fixed in f62a3f606db3163b85666a0b8997e52987c87e97. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. The vulnerability, identified as pdf14_preserve_backdrop, is a heap-buffer-overflow issue in Ghostscript. This vulnerability can be triggered when processing certain PDF files, leading to a write overflow in the heap memory. The vulnerability was discovered through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability arises in the pdf14_preserve_backdrop function of Ghostscript. When processing a PDF file, a heap-buffer-overflow occurs during a write operation. This can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability has been assigned a severity rating of HIGH. The crash state indicates that the issue occurs in the pdf14_preserve_backdrop, pdf14_push_transparency_group, and pdf14_begin_transparency_group functions.
How To Fix
Minimum fixed version
f62a3f606db3163b85666a0b8997e52987c87e97
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can exercise caution when processing PDF files with Ghostscript. Avoid opening PDF files from untrusted sources or unknown origins. Additionally, consider using alternative PDF processing tools until the vulnerability is patched.
Conclusion
In conclusion, the pdf14_preserve_backdrop vulnerability in Ghostscript poses a risk of arbitrary code execution or denial-of-service. It is crucial to update Ghostscript to a patched version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
The vulnerability was discovered through the OSS-Fuzz project, which focuses on fuzzing open-source software to uncover vulnerabilities.
This vulnerability has been assigned a severity rating of HIGH.
To fix this vulnerability, update Ghostscript to a version that includes the fix. The commit f62a3f606db3163b85666a0b8997e52987c87e97 on the Ghostscript Git repository addresses this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
