Ghostscript NULL Pointer Dereference Vulnerability - CVE-2022-2085
Summary
UBUNTU-CVE-2022-2085: A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. Affects ghostscript versions < 9.55.0~dfsg1-0ubuntu5.1. Fixed in 9.55.0~dfsg1-0ubuntu5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for rendering documents and converting them between formats. The package is essential for applications that require document processing capabilities. However, it has been found to be vulnerable to a NULL pointer dereference, which can lead to application crashes when handling certain image formats.
Vulnerability Detail
A NULL pointer dereference vulnerability was identified in Ghostscript, specifically when it attempts to render images with a high number of bits per pixel (bpp). This occurs during buffer device allocation, where the system relies on an undefined prototype for devices using more than 64 bits per pixel. An attacker can exploit this flaw by sending specially crafted input, leading to a crash of the application. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate risk level.
How To Fix
Minimum fixed version
9.55.0~dfsg1-0ubuntu5.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input to Ghostscript to ensure that it does not process images with more than 64 bits per pixel. This may involve modifying the source of the documents being processed or implementing checks before passing data to Ghostscript.
Conclusion
The Ghostscript NULL pointer dereference vulnerability (CVE-2022-2085) poses a moderate risk to applications that utilize this package for document processing. It is crucial to update to the latest patched version to ensure the security and stability of your applications. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2022-2085 is a vulnerability in Ghostscript that allows for a NULL pointer dereference, potentially crashing the application.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
Exploitation of this vulnerability can lead to application crashes, which may disrupt services that rely on Ghostscript for document processing.
Yes, a patched version of Ghostscript is available. Update to version 9.55.0~dfsg1-0ubuntu5.1 or later to mitigate the risk.
If immediate updates are not possible, consider implementing input validation to restrict the processing of images with high bits per pixel as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
