A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The rsearch calculation for the post size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Weakness
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ghostscript | Artifex | 9.50 (including) | 9.50 (including) |
| Ghostscript | Artifex | 9.52 (including) | 9.52 (including) |
| Ghostscript | Ubuntu | devel | * |
| Ghostscript | Ubuntu | esm-infra/focal | * |
| Ghostscript | Ubuntu | focal | * |
| Ghostscript | Ubuntu | trusty | * |
References
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=log
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00006.html
- https://artifex.com/security-advisories/CVE-2020-15900
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5d499272b95a6b890a1397e11d20937de000d31b
- https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b
- https://github.com/ArtifexSoftware/ghostpdl/commits/master/psi/zstring.c
- https://security.gentoo.org/glsa/202008-20
- https://usn.ubuntu.com/4445-1/
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=log
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00006.html
- https://artifex.com/security-advisories/CVE-2020-15900
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5d499272b95a6b890a1397e11d20937de000d31b
- https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b
- https://github.com/ArtifexSoftware/ghostpdl/commits/master/psi/zstring.c
- https://security.gentoo.org/glsa/202008-20
- https://usn.ubuntu.com/4445-1/