Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.1
CVSSv2

CVE-2006-5864

Published: 11/11/2006 Updated: 17/10/2018
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
VMScore: 515
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Subscribe to Gnu

Vulnerability Summary

Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted malicious users to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1) DocumentMedia, (2) DocumentPaperSizes, and possibly (3) PageMedia and (4) PaperSize headers. NOTE: this issue can be exploited through other products that use gv such as evince.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu gv 3.6.0

gnu gv 3.6.1

gnu gv 3.6.2

gnu gv 3.5.8

Vendor Advisories

Debian CVElist Bug Report Logs: GNU gv "ps_gettext()" Buffer Overflow Vulnerability (CVE-2006-5864)
Debian Bug report logs - #398292 GNU gv "ps_gettext()" Buffer Overflow Vulnerability (CVE-2006-5864) Package: gv; Maintainer for gv is Bernhard R Link <brlink@debianorg>; Source for gv is src:gv (PTS, buildd, popcon) Reported by: Stefan Fritsch <sf@sfritschde> Date: Sun, 12 Nov 2006 21:18:06 UTC Severity: grave T ...
Ubuntu Security Notice: evince vulnerability
USN-390-1 fixed a vulnerability in evince The original fix did not fully solve the problem, allowing for a denial of service in certain situations ...
Ubuntu Security Notice: evince vulnerability
A buffer overflow was discovered in the PostScript processor included in evince By tricking a user into opening a specially crafted PS file, an attacker could crash evince or execute arbitrary code with the user’s privileges ...
Ubuntu Security Notice: evince-gtk vulnerability
USN-390-2 fixed vulnerabilities in evince This update provides the corresponding update for evince-gtk ...
Debian Security Advisories: DSA-1214-2 gv -- buffer overflow
The original update provided in DSA 1214-1 was insufficient; this update corrects this For reference please find the original advisory text below: Renaud Lifchitz discovered that gv, the PostScript and PDF viewer for X, performs insufficient boundary checks in the Postscript parsing code, which allows the execution of arbitrary code through a bu ...
Debian Security Advisories: DSA-1243-1 evince -- buffer overflow
Renaud Lifchitz discovered that gv, the PostScript and PDF viewer for X, performs insufficient boundary checks in the Postscript parsing code, which allows the execution of arbitrary code through a buffer overflow Evince embeds a copy of gv and needs an update as well For the stable distribution (sarge) this problem has been fixed in version 01 ...

Exploits

Exploit DB: Evince Document Viewer - 'DocumentMedia' Remote Buffer Overflow
/* * Creator: K-sPecial (xzziroznet) of aware (awarenetworkorg) * Name: evince-ps-field-bofc * Date: 11/27/2006 * Version: * 100 - creation * * Other: this idea originaly came from the bid for the 'gv' buffer overflow (20978), i don't * believe it's known until now that evince is also vulnerable * * Compile: gcc -o epfb evince-p ...

References

CWE-119http://www.securityfocus.com/bid/20978http://secunia.com/advisories/22787http://www.debian.org/security/2006/dsa-1214http://www.novell.com/linux/security/advisories/2006_26_sr.htmlhttp://secunia.com/advisories/23006http://secunia.com/advisories/23018http://security.gentoo.org/glsa/glsa-200611-20.xmlhttp://secunia.com/advisories/23118http://www.kb.cert.org/vuls/id/352825http://secunia.com/advisories/23111http://www.ubuntu.com/usn/usn-390-1http://secunia.com/advisories/23183http://www.ubuntu.com/usn/usn-390-2http://www.ubuntu.com/usn/usn-390-3http://secunia.com/advisories/23266https://issues.rpath.com/browse/RPL-850http://www.novell.com/linux/security/advisories/2006_28_sr.htmlhttp://secunia.com/advisories/23306http://secunia.com/advisories/23353http://secunia.com/advisories/23335http://www.novell.com/linux/security/advisories/2006_29_sr.htmlhttp://secunia.com/advisories/23409http://www.debian.org/security/2006/dsa-1243http://secunia.com/advisories/23579http://security.gentoo.org/glsa/glsa-200703-24.xmlhttp://secunia.com/advisories/22932http://security.gentoo.org/glsa/glsa-200704-06.xmlhttp://secunia.com/advisories/24787http://www.mandriva.com/security/advisories?name=MDKSA-2006:214http://www.mandriva.com/security/advisories?name=MDKSA-2006:229http://secunia.com/advisories/24649http://www.vupen.com/english/advisories/2006/4424http://www.vupen.com/english/advisories/2006/4747https://exchange.xforce.ibmcloud.com/vulnerabilities/30555https://exchange.xforce.ibmcloud.com/vulnerabilities/30153https://www.exploit-db.com/exploits/2858http://www.securityfocus.com/archive/1/452868/100/0/threadedhttp://www.securityfocus.com/archive/1/451422/100/200/threadedhttp://www.securityfocus.com/archive/1/451057/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=398292https://nvd.nist.govhttps://usn.ubuntu.com/390-2/https://www.exploit-db.com/exploits/2858/https://www.kb.cert.org/vuls/id/352825
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322cross-site request forgeryunauthorizedCVE-2024-33925reflected XSSCVE-2023-51580CVE-2023-51579CVE-2015-2051CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook