Bug 2247179 (CVE-2020-27792)

Summary:	CVE-2020-27792 ghostscript: heap buffer over write vulnerability in GhostScript's lp8000_print_page() in gdevlp8k.c
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kyoshida, mjg, prodsec-ir-bot, vsroka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ghostscript 9.27	Doc Type:	If docs needed, set a value
Doc Text:	A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2250779
Bug Blocks:	2247177

Description Rohit Keshri 2023-10-31 06:18:15 UTC

A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

Reference:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f6bc662909ab79e8fbe9822afb36e8a0eafc2b7

Comment 4 Sandipan Roy 2023-11-21 06:00:23 UTC

Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 2250779]

Comment 5 Michael J Gruber 2023-11-21 20:45:40 UTC

Is there a particular reason why this CVE from 2020 is filed now?
Why is it marked "Affects: fedora-all" if it is marked "Fixed In Version: ghostscript 9.27" at the same time? That version is from 2019, and we had it in Fedora 29 already.