CVE-2020-16294: 
Ghostscript vulnerability analysis and mitigation

CVE-2020-16294 is a buffer overflow vulnerability discovered in the epsc_print_page() function within devices/gdevepsc.c of Artifex Software GhostScript version 9.50. The vulnerability was reported on October 26, 2019, and fixed in version 9.51 (Ghostscript Bug).

The vulnerability is a global buffer overflow that occurs in the epsc_print_page() function at line 186 in devices/gdevepsc.c. When processing certain PDF files, the function attempts to read 4 bytes at an invalid memory location, which triggers a buffer overflow condition. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium), with attack vector being Local, attack complexity Low, privileges required None, and user interaction Required (Ubuntu Security).

When exploited, this vulnerability allows a remote attacker to cause a denial of service condition through a specially crafted PDF file (NVD).

The vulnerability can be triggered by processing a maliciously crafted PDF file using the affected versions of GhostScript. A proof of concept exploit was provided in the original bug report demonstrating the buffer overflow using the command 'gs -r680 -sOutputFile=tmp -sDEVICE=epsonc' with a crafted PDF file (Ghostscript Bug).

The vulnerability was fixed in GhostScript version 9.51. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu (USN-4469-1), Debian (DSA-4748), and Gentoo (GLSA 202008-20) (Ubuntu Notice, Debian Security, Gentoo Security).