CVE-2020-16310: 
Ghostscript vulnerability analysis and mitigation

A division by zero vulnerability was discovered in the dot24_print_page() function in devices/gdevdm24.c of Artifex Software GhostScript version 9.50. This vulnerability was assigned CVE-2020-16310 and was publicly disclosed in August 2020 (NVD, Ubuntu).

The vulnerability occurs when the bytes_per_space variable, calculated as dots_per_space * 3, becomes zero. This happens when xres (resolution) is less than 3, causing dots_per_space (calculated as xres / 10) to become zero. The issue affects the dot matrix printer device driver in GhostScript (Ghostscript Bug). The vulnerability has a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows a remote attacker to cause a denial of service condition by processing a specially crafted PDF file (Ubuntu, Debian).

The vulnerability can be triggered by processing a specially crafted PDF file with GhostScript. A proof of concept exploit was submitted to the GhostScript bug tracker demonstrating the division by zero condition (Ghostscript Bug).

The vulnerability was fixed in GhostScript version 9.51. Various Linux distributions have released security updates to address this issue: Ubuntu has released updates for versions 20.04 LTS, 18.04 LTS, and 16.04 LTS (Ubuntu Notice), Debian has released updates for version 10 (buster) (Debian Advisory), and Gentoo has released updates to version 9.52 (Gentoo Advisory).