Heap-buffer-overflow in ghostscript: default_get_outline
Summary
OSV-2023-527: Heap-buffer-overflow in default_get_outline. Affects ghostscript versions >= ce81cd8afab80b9af62c99add1ba7a372f5cbfc7, < ae26dddc15c9869864839853e87482468cab3db7. Fixed in ae26dddc15c9869864839853e87482468cab3db7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability in question, identified as OSV-2023-527, is a heap-buffer-overflow issue that affects the default_get_outline function in Ghostscript. This function is responsible for retrieving the outline of a PDF document. The vulnerability can be triggered when processing a specially crafted PDF file, leading to a heap-buffer-overflow read of 4 bytes.
Vulnerability Detail
The heap-buffer-overflow vulnerability in default_get_outline function of Ghostscript can be exploited by an attacker by providing a maliciously crafted PDF file. When the vulnerable function attempts to retrieve the outline of the PDF document, it reads beyond the bounds of the allocated buffer, resulting in a heap-buffer-overflow read of 4 bytes. This can lead to various consequences, including information disclosure, denial of service, or potential remote code execution. The vulnerability was discovered through the OSS-Fuzz project and has been assigned a medium severity rating.
How To Fix
Minimum fixed version
ae26dddc15c9869864839853e87482468cab3db7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malicious PDF files with Ghostscript. By refraining from opening or converting PDF files from untrusted sources, the risk of exploitation can be mitigated. However, this is not a permanent solution and updating to a patched version of Ghostscript is strongly recommended.
Conclusion
In conclusion, the heap-buffer-overflow vulnerability in Ghostscript's default_get_outline function poses a potential risk of information disclosure, denial of service, or remote code execution. Users are advised to update their installations to a version that includes the fix or apply the recommended workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The vulnerability can potentially lead to information disclosure, denial of service, or remote code execution, depending on how it is exploited.
To fix this vulnerability, update Ghostscript to a version that includes the fix. Refer to the provided commit in the Ghostscript Git repository for the specific fix.
As a temporary workaround, avoid processing untrusted or malicious PDF files with Ghostscript. This can help mitigate the risk of exploitation, but updating to a patched version is still recommended.
For more information about this vulnerability, refer to the provided OSS-Fuzz report and the associated GitHub source.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
