PT-2020-5551 · Artifex+6 · Ghostscript+6

Suhwan · Published 2020-08-13 · Updated 2022-06-29 · CVE-2020-16303

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GhostScript versions 9.50

Description A use-after-free issue in the xps finish image path() function allows a remote attacker to escalate privileges via a crafted PDF file. This issue may impact the confidentiality, integrity, and availability of protected information.

Recommendations For GhostScript version 9.50, update to version 9.51 to resolve the issue.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2021:1852

BDU:2021-01150

CESA-2021_1852

CVE-2020-16303

DLA-2335-1

DSA-4748-1

MGASA-2020-0344

RHSA-2021:1852

RHSA-2021_1852

RLSA-2021:1852

USN-4469-1

Affected Products

Almalinux

Centos

Ghostscript

Linuxmint

Red Hat

Rocky Linux

Ubuntu

References · 115

• 🔥 https://bugs.ghostscript.com/show_bug.cgi?id=701818 · Exploit
• https://ubuntu.com/security/CVE-2020-16288 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16295 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4469-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16298 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:1852 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-1852.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16303 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16297 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0344 · Vendor Advisory
• https://usn.ubuntu.com/4469-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2335-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4469-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17538 · Vendor Advisory