Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0583

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Published

2009-03-23T20:00:00.343

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ghostscript	ghostscript	≤ 8.64	Yes
Application	ghostscript	ghostscript	5.50	Yes
Application	ghostscript	ghostscript	7.05	Yes
Application	ghostscript	ghostscript	7.07	Yes
Application	ghostscript	ghostscript	8.0.1	Yes
Application	ghostscript	ghostscript	8.15	Yes
Application	ghostscript	ghostscript	8.15.2	Yes
Application	ghostscript	ghostscript	8.54	Yes
Application	ghostscript	ghostscript	8.56	Yes
Application	ghostscript	ghostscript	8.57	Yes
Application	ghostscript	ghostscript	8.61	Yes
Application	ghostscript	ghostscript	8.62	Yes
Application	ghostscript	ghostscript	8.63	Yes
Application	argyllcms	argyllcms	≤ 1.0.3	Yes
Application	argyllcms	argyllcms	0.1.0	Yes
Application	argyllcms	argyllcms	0.2.0	Yes
Application	argyllcms	argyllcms	0.2.1	Yes
Application	argyllcms	argyllcms	0.2.2	Yes
Application	argyllcms	argyllcms	0.3.0	Yes
Application	argyllcms	argyllcms	0.6.0	Yes
Application	argyllcms	argyllcms	0.7.0	Yes
Application	argyllcms	argyllcms	1.0.0	Yes
Application	argyllcms	argyllcms	1.0.2	Yes

References

http://bugs.gentoo.org/show_bug.cgi?id=261087 ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html ([email protected])
http://secunia.com/advisories/34266 Vendor Advisory ([email protected])
http://secunia.com/advisories/34373 Vendor Advisory ([email protected])
http://secunia.com/advisories/34381 Vendor Advisory ([email protected])
http://secunia.com/advisories/34393 Vendor Advisory ([email protected])
http://secunia.com/advisories/34398 Vendor Advisory ([email protected])
http://secunia.com/advisories/34418 Vendor Advisory ([email protected])
http://secunia.com/advisories/34437 Vendor Advisory ([email protected])
http://secunia.com/advisories/34443 Vendor Advisory ([email protected])
http://secunia.com/advisories/34469 Vendor Advisory ([email protected])
http://secunia.com/advisories/34729 ([email protected])
http://secunia.com/advisories/35559 ([email protected])
http://secunia.com/advisories/35569 ([email protected])
http://securitytracker.com/id?1021868 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1 ([email protected])
http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm ([email protected])
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050 Vendor Advisory ([email protected])
http://www.auscert.org.au/render.html?it=10666 US Government Resource ([email protected])
http://www.debian.org/security/2009/dsa-1746 Vendor Advisory ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200903-37.xml ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:095 ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:096 ([email protected])
http://www.redhat.com/support/errata/RHSA-2009-0345.html Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/501994/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/34184 ([email protected])
http://www.ubuntu.com/usn/USN-743-1 ([email protected])
http://www.vupen.com/english/advisories/2009/0776 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/0777 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/0816 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1708 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=487742 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/49329 ([email protected])
https://issues.rpath.com/browse/RPL-2991 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10795 ([email protected])
https://usn.ubuntu.com/757-1/ ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00770.html Vendor Advisory ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00772.html Vendor Advisory ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00887.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00916.html ([email protected])
http://bugs.gentoo.org/show_bug.cgi?id=261087 (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34266 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34373 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34381 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34393 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34398 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34418 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34437 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34443 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34469 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34729 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35559 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35569 (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1021868 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1 (af854a3a-2127-422b-91ae-364da2661108)
http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm (af854a3a-2127-422b-91ae-364da2661108)
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.auscert.org.au/render.html?it=10666 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1746 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200903-37.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:095 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:096 (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2009-0345.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/501994/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/34184 (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-743-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/0776 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/0777 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/0816 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1708 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=487742 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/49329 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.rpath.com/browse/RPL-2991 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10795 (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/757-1/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00770.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00772.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00887.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00916.html (af854a3a-2127-422b-91ae-364da2661108)