CVE-2020-16303: 
Ghostscript vulnerability analysis and mitigation

CVE-2020-16303 is a use-after-free vulnerability discovered in Artifex Software GhostScript version 9.50, specifically in the xps_finish_image_path() function located in devices/vector/gdevxps.c. The vulnerability was disclosed in August 2020 and affects the GhostScript PostScript and PDF interpreter (NVD, CVE).

The vulnerability is classified as a use-after-free issue that occurs when processing certain PDF files. The flaw specifically manifests in the xps_finish_image_path() function within the devices/vector/gdevxps.c component. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability could allow a remote attacker to escalate privileges through a specially crafted PDF file. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability requires user interaction to process a maliciously crafted PDF file. An exploit has been confirmed and documented in the bug tracking system (Ghostscript Bug).

The vulnerability has been fixed in GhostScript version 9.51. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and Gentoo. Users are advised to upgrade to the patched version (Ubuntu Notice, Debian Advisory, Gentoo Advisory).