Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 852944 (CVE-2022-2085) - <app-text/ghostscript-gpl-9.56.1: null pointer dereference
Summary: <app-text/ghostscript-gpl-9.56.1: null pointer dereference
Alias: CVE-2022-2085
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa+]
Depends on: 862133
  Show dependency tree
Reported: 2022-06-18 19:07 UTC by John Helmert III
Modified: 2023-07-25 03:31 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-18 19:07:24 UTC

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-06-18 19:24:29 UTC
We should backport the patch, 9.56.1 is completely useless.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-18 20:58:37 UTC
GLSA request filed
Comment 3 Larry the Git Cow gentoo-dev 2022-11-22 04:01:26 UTC
The bug has been referenced in the following commit(s):

commit ae2df9a36eb30967fc9dd392f63bc7af60249272
Author:     GLSAMaker <>
AuthorDate: 2022-11-22 03:53:57 +0000
Commit:     John Helmert III <>
CommitDate: 2022-11-22 03:59:40 +0000

    [ GLSA 202211-11 ] GPL Ghostscript: Multiple Vulnerabilities
    Signed-off-by: GLSAMaker <>
    Signed-off-by: John Helmert III <>

 glsa-202211-11.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-22 04:06:47 UTC
GLSA released, waiting for cleanup