Published: 14/04/2009 Updated: 07/11/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and previous versions and Argyll Color Management System (CMS) 1.0.3 and previous versions, allow context-dependent malicious users to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ghostscript ghostscript 7.07
ghostscript ghostscript 8.62
ghostscript ghostscript 8.57
ghostscript ghostscript 8.54
ghostscript ghostscript 7.05
ghostscript ghostscript
ghostscript ghostscript 5.50
ghostscript ghostscript 8.15
ghostscript ghostscript 8.56
ghostscript ghostscript 8.15.2
ghostscript ghostscript 8.0.1
ghostscript ghostscript 8.61
ghostscript ghostscript 8.63
argyllcms argyllcms 0.2.2
argyllcms argyllcms
argyllcms argyllcms 0.6.0
argyllcms argyllcms 0.1.0
argyllcms argyllcms 0.7.0
argyllcms argyllcms 0.2.1
argyllcms argyllcms 0.2.0
argyllcms argyllcms 0.3.0
argyllcms argyllcms 1.0.2
argyllcms argyllcms 1.0.0

It was discovered that Ghostscript contained a buffer underflow in its CCITTFax decoding filter If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program (CVE-2007-6725) ...

Synopsis Moderate: ghostscript security update Type/Severity Security Advisory: Moderate Topic Updated ghostscript packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5This update has been rated as having moderate security impact by the RedHat Security Response Team ...

Synopsis Moderate: ghostscript security update Type/Severity Security Advisory: Moderate Topic Updated ghostscript packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 3 and 4This update has been rated as having moderate security impact by the RedHat Security Response Te ...

Several security issues have been discovered in Ghostscript, a GPL PostScript/PDF interpreter, which might lead to the execution of arbitrary code if a user processes a malformed PDF or Postscript file For the stable distribution (lenny), these problems have been fixed in version 862dfsg1-32lenny4 For the unstable distribution (sid), these pr ...

Debian Bug report logs - #523472 argyll: CVE-2009-0792 integer overflows Package: argyll; Maintainer for argyll is Jörg Frings-Fürst <debian@jffemail>; Source for argyll is src:argyll (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Fri, 10 Apr 2009 14:24:02 UTC Severity ...

Debian Bug report logs - #524803 ghostscript: multiple vulnerabilities Package: ghostscript; Maintainer for ghostscript is Debian Printing Team <debian-printing@listsdebianorg>; Source for ghostscript is src:ghostscript (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Mon, ...

Debian Bug report logs - #522416 ghostscript: CVE-2009-058{3,4} multiple integer overflows resulting in arbitrary code execution Package: ghostscript; Maintainer for ghostscript is Debian Printing Team <debian-printing@listsdebianorg>; Source for ghostscript is src:ghostscript (PTS, buildd, popcon) Reported by: Nico Golde ...

Get Started

CVE-2009-0792

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect