CVE-2020-14373
ghostscript: use-after-free vulnerability in igc_reloc_struct_ptr() could result in DoS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a denial of service.
Se encontró un uso de la memoria previamente liberada en la función igc_reloc_struct_ptr() del archivo psi/igc.c de ghostscript-9.25. Un atacante local podría suministrar un archivo PDF especialmente diseñado para causar una denegación de servicio
A use-after-free flaw was found in igc_reloc_struct_ptr() of psi/igc.c of Ghostscript-9.25. This flaw allows a local attacker to supply a specially crafted PDF file, causing a denial of service. The highest threat from this vulnerability is to system availability.
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Issues addressed include buffer overflow, denial of service, null pointer, privilege escalation, and use-after-free vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-06-17 CVE Reserved
- 2020-09-03 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=ece5cbbd9979cd35737b00e68267762d72feb2ea%3Bhp=1ef5f08f2c2e27efa978f0010669ff22355c385f | X_refsource_misc |
| URL | Date | SRC |
|---|---|---|
| https://bugs.ghostscript.com/show_bug.cgi?id=702851 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1873239 | 2021-05-18 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-14373 | 2021-05-18 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Artifex Search vendor "Artifex" | Ghostscript Search vendor "Artifex" for product "Ghostscript" | 9.25 Search vendor "Artifex" for product "Ghostscript" and version "9.25" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||