Input validation error in Ghostscript - CVE-2020-16310

Vulnerability identifier: #VU45852

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2020-16310

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
Ghostscript
Gentoo Linux
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
ghostscript (Debian package)
ghostscript (Alpine package)
ghostscript (Ubuntu package)
libgs9 (Ubuntu package)
ghostscript (Red Hat package)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in gdevdm24.c. A remote attacker can cause a denial of service via a crafted PDF file.

Install update from vendor's website.

• https://bugs.ghostscript.com/show_bug.cgi?id=701828
• https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=eaba1d97b62831b42c51840cc8ee2bc4576c942e
• https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html