Critical Vulnerability in Ghostscript Package Allows Remote Application Crash
Summary
UBUNTU-CVE-2023-46751: An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. Affects ghostscript versions < 9.55.0~dfsg1-0ubuntu5.6. Fixed in 9.55.0~dfsg1-0ubuntu5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation and rendering capabilities. However, a recent vulnerability has been identified that could allow remote attackers to exploit the application, leading to potential crashes.
Vulnerability Detail
An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through version 10.02.0. This vulnerability allows remote attackers to crash the application via a dangling pointer. The vulnerability originates from improper handling of pointers, which can lead to application instability and denial of service. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.55.0~dfsg1-0ubuntu5.6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality of Ghostscript until the package is updated. This may involve disabling certain features or using alternative software for document processing.
Conclusion
The vulnerability in the Ghostscript package poses a significant risk, allowing remote attackers to crash the application. It is crucial for users to update to the patched versions to protect against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows remote attackers to crash the Ghostscript application through a dangling pointer in the gdev_prn_open_printer_seekable() function.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The primary impact is a denial of service, where the application may crash unexpectedly, disrupting workflows and processes that rely on Ghostscript.
Yes, there are patched versions available for both Ubuntu 22.04 LTS and 24.04 LTS. Users should update to the specified versions to mitigate the risk.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
