CVE-2021-45949CWE-122CWE-787

CVE-2021-45949

Medium · published January 1, 2022

CVSS v3.1
5.5
EPSS
2%
Percentile
75.9
In the wild
Unconfirmed
What it is

Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01619 · 75.9th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2022-01-01T05:15Z
Affected products (4)
ProductVersionsFixed in
artifex/ghostscript≥ 9.50, ≤ 9.54.0—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (10)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 · [email protected]https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7 · [email protected]https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml · [email protected]https://lists.debian.org/debian-lts-announce/2022/01/msg00006.html · [email protected]https://www.debian.org/security/2022/dsa-5038 · [email protected]https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 · af854a3a-2127-422b-91ae-364da2661108https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7 · af854a3a-2127-422b-91ae-364da2661108https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/01/msg00006.html · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5038 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 31 DEC 23:54Z
    Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp)
    cvelistv5