Ubuntu.comUB:CVE-2022-1350CVE-2022-1350
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
32.2%
A vulnerability classified as problematic was found in GhostPCL 9.55.0.
This vulnerability affects the function chunk_free_object of the file
gsmchunk.c. The manipulation with a malicious file leads to a memory
corruption. The attack can be initiated remotely but requires user
interaction. The exploit has been disclosed to the public as a POC and may
be used. It is recommended to apply the patches to fix this issue.
Bugs
Notes
| Author | Note |
|---|---|
| iconstantin | Issue impacts GhostPCL, we currently do not build with PCL support. |
| mdeslaur | First commit fixes pcl/pcl/pcstatus.c, while this file exists in the focal source package (only), it does not appear to get built as debian/rules contains --without-pcl. The reproducer in the upstream bug needs PCL support to work. The second commit does fix a file that is built in Ubuntu ghostscript packages, but there is no indication that it is security relevant without the PCL support. Marking as “low” for now until further information becomes available. |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
32.2%