Bug 2048939 (CVE-2021-45949) - CVE-2021-45949 ghostscript: heap-based buffer overflow in sampled_data_finish
Summary: CVE-2021-45949 ghostscript: heap-based buffer overflow in sampled_data_finish
Keywords:
Status: NEW
Alias: CVE-2021-45949
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2049765 2049766 2049767
Blocks: 2048917
TreeView+ depends on / blocked
 
Reported: 2022-02-01 08:37 UTC by Marian Rehak
Modified: 2024-02-01 01:40 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow flaw was found in Ghostscript’s GhostPDL in the sampled_data_finish function (called from sampled_data_continue and interp). This flaw allows a local attacker to pass a specially crafted malicious file to Ghostscript that triggers a heap-based buffer overflow, potentially causing a crash that leads to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2022-02-01 08:37:50 UTC 
A heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).

Reference:

https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
Comment 1 Michael J Gruber 2022-02-01 14:25:12 UTC 
Fedora versions all the way down to F33 are not affected - they carry  ghostscript-9.55.0.

So, which version are you reporting this against?
Note You need to log in before you can comment on or make changes to this bug.