CVE-2020-21710 Denial of service in n/a
Remote attackers can cause a denial of service by tricking users into opening a crafted PDF file processed by GhostScript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-21710?
CVE-2020-21710 is a medium-severity denial of service vulnerability in Artifex Ghostscript, published on 22 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file.
Weakness: CWE-369
Which versions are affected by CVE-2020-21710?
It affects 1 product.
Linux distribution packages (27)
ghostscript AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript-doc AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript-tools-dvipdf AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript-tools-fonts AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript-tools-printing AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript-x11 AlmaLinux:8 | All versions | 9.27-12.el8 |
libgs AlmaLinux:8 | All versions | 9.27-12.el8 |
libgs-devel AlmaLinux:8 | All versions | 9.27-12.el8 |
ghostscript Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-gtk-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-x11 Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-x11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
libgs Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
libgs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.27-12.el8 |
ghostscript-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-doc Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-gtk-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-tools-dvipdf Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-tools-fonts Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-tools-printing Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript-x11-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
libgs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
libgs-devel Red Hat:enterprise_linux:8::crb | All versions | 0:9.27-12.el8 |
ghostscript Rocky Linux:8 | All versions | 0:9.27-12.el8 |
Products include Artifex Ghostscript.
How do I fix CVE-2020-21710?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-21710 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-21710 exists.
Other vulnerabilities in Artifex Ghostscript
Sources
Also known as ALSA-2024:2966, DEBIAN-CVE-2020-21710, GHSA-f3hj-4f92-87v9, RHSA-2024:2966, RLSA-2024:2966, UBUNTU-CVE-2020-21710.