CVE-2020-16306: 
Ghostscript vulnerability analysis and mitigation

CVE-2020-16306 is a null pointer dereference vulnerability discovered in devices/gdevtsep.c of Artifex Software GhostScript version 9.50. The vulnerability was reported on August 12, 2020, and affects the GhostScript PostScript and PDF interpreter (NVD).

The vulnerability is characterized as a null pointer dereference issue in the devices/gdevtsep.c component of GhostScript. It has been assigned a CVSS v3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability requires user interaction and has a local attack vector (NVD).

When exploited, this vulnerability allows a remote attacker to cause a denial of service condition through a crafted postscript file. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered by processing a specially crafted postscript file. A proof of concept exploit has been documented in the bug tracking system (Ghostscript Bugzilla).

The vulnerability has been fixed in GhostScript version 9.51. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu (9.50~dfsg-5ubuntu4.2), Debian (9.27~dfsg-2+deb10u4), and Red Hat Enterprise Linux (Ubuntu Security, Debian Security).