PT-2009-3228 · Artifex+2 · Ghostscript+2

Jan Lieskovsky · Published 2009-03-19 · Updated 2018-10-10 · CVE-2009-0584

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ghostscript versions 8.64 and earlier Argyll Color Management System (CMS) versions 1.0.3 and earlier

Description The issue allows context-dependent attackers to cause a denial of service, resulting in an application crash, or possibly execute arbitrary code. This can be achieved by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a PostScript or a PDF file with embedded images.

Recommendations For Ghostscript versions 8.64 and earlier, consider updating to a newer version to mitigate the risk. For Argyll Color Management System (CMS) versions 1.0.3 and earlier, consider updating to a newer version to mitigate the risk. As a temporary workaround, consider restricting the use of ICC profiles in PostScript or PDF files with embedded images until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0584

DSA-1746-1

DTSA-198-1

RHSA-2009:0345

RHSA-2009_0345

Affected Products

Argyll Color Management System

Ghostscript

Red Hat

References · 48

• https://nvd.nist.gov/vuln/detail/CVE-2009-0584 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00916.html · Vendor Advisory
• http://secunia.com/advisories/34381 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0584 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200903-37.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:095 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:096 · Vendor Advisory
• http://secunia.com/advisories/34373 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0584 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0584 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0345.html · Vendor Advisory
• http://secunia.com/advisories/34393 · Vendor Advisory
• http://secunia.com/advisories/34437 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00887.html · Vendor Advisory
• https://usn.ubuntu.com/757-1 · Vendor Advisory