CVE-2020-16307: Null Pointer Dereference
A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 9.53.3~dfsg-7+deb11u7Fixed in 9.53.3~dfsg-7+deb11u11Fixed in 10.0.0~dfsg-11+deb12u8Fixed in 10.05.1~dfsg-1+deb13u1Fixed in 10.07.0~dfsg-2 - Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 9.51 - Upgrade
Upgrade
Artifex Software GhostScriptto a version that resolves this vulnerability.Fixed in v9.51 - Compensating control
If immediate upgrade is not possible, mitigate the denial-of-service risk by restricting/isolating exposure to untrusted PostScript input (e.g., limit who can submit PostScript and process it in an isolated environment).
- Operational
After upgrading GhostScript to v9.51, restart any services that run GhostScript to ensure the vulnerable code path is not used by existing processes.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-16307.
What is the severity of CVE-2020-16307?
The severity of CVE-2020-16307 is medium, with a severity value of 5.5.
Which software versions are affected by CVE-2020-16307?
The affected software versions are GhostScript v9.50 (Artifex Software), 9.27~dfsg-2+deb10u5, 9.27~dfsg-2+deb10u9, 9.53.3~dfsg-7+deb11u6, 9.53.3~dfsg-7+deb11u5, 10.0.0~dfsg-11+deb12u2, 10.0.0~dfsg-11+deb12u1, 10.02.0~dfsg-2 (Debian), 9.26~dfsg+0-0ubuntu0.18.04.13 (Ubuntu 18.04), and 9.50~dfsg-5ubuntu4.2, 9.51~dfsg-1 (Ubuntu 20.04).
How does CVE-2020-16307 impact the software?
CVE-2020-16307 allows a remote attacker to cause a denial of service through a crafted postscript file.
How can I fix CVE-2020-16307?
CVE-2020-16307 is fixed in GhostScript v9.51 (Artifex Software). Users should update to this version or apply the respective patches provided by the software vendor (Red Hat, Debian, or Ubuntu).