CVE-2020-36773

An out-of-bounds write, and a use-after-free flaw was found in Ghostscript. The flaw is present in devices/vector/gdevtxtw.c, for txtwrite, due to a single character code in a PDF document that can map to more than one Unicode code point (for example, a ligature).

The identified vulnerability in Ghostscript introduced in version 9.50 and FIxed in 9.53.0, this represents a important security issue due to its potential for exploitation by malicious actors. The out-of-bounds write and use-after-free flaws in the txtwrite module can be leveraged to execute arbitrary code or trigger denial-of-service attacks, compromising the integrity, confidentiality, and availability of systems where Ghostscript is deployed. Given the widespread use of Ghostscript in handling PDF documents across various platforms and applications, the vulnerability poses a significant risk to users' data and infrastructure.

Red Hat Enterprise Linux is Not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.