CVE-2020-14373: 
Ghostscript vulnerability analysis and mitigation

CVE-2020-14373 is a use-after-free vulnerability discovered in Ghostscript version 9.25, specifically in the igc_reloc_struct_ptr() function of psi/igc.c. The vulnerability was reported on August 27, 2020, and affects the Ghostscript PDF processing software (CVE Details, Red Hat CVE).

The vulnerability occurs in the igc_reloc_struct_ptr() function on line 1279 of psi/igc.c when processing certain PDF files. The flaw is triggered by improper handling of fonts when processing specially crafted PDF files, leading to a use-after-free condition. The issue was fixed in version 9.26rc1 through a commit that addressed the font handling mechanism (Ghostscript Bug, Git Commit).

When exploited, this vulnerability can lead to a denial of service (DoS) condition. The impact is considered moderate as it requires local access and can only affect system availability without compromising confidentiality or integrity (Ubuntu CVE).

The vulnerability requires local access and low complexity to exploit. An attacker needs to supply a specially crafted PDF file to trigger the vulnerability. The CVSS base score is 5.5 (Medium), with attack vector being Local, attack complexity Low, and privileges required Low (Ubuntu CVE).

The vulnerability was fixed in Ghostscript version 9.26rc1. Users should upgrade to this version or later to mitigate the issue. Red Hat has addressed this vulnerability in Red Hat Enterprise Linux 8 through RHSA-2021:1852 security advisory (Red Hat Advisory).