PT-2010-1303 · Artifex+3 · Ghostscript+3

Jonathan Brossard · Published 2010-08-26 · Updated 2018-10-10 · CVE-2009-3743

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 8.71

Description The issue is related to an off-by-one error in the Ins MINDEX function within the TrueType bytecode interpreter. This error can be triggered by a malformed TrueType font in a document, leading to an integer overflow and a heap-based buffer overflow. As a result, remote attackers may be able to execute arbitrary code or cause a denial of service due to heap memory corruption.

Recommendations For versions prior to 8.71, update to version 8.71 or later to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CESA-2012_0095

CVE-2009-3743

RHSA-2012:0095

RHSA-2012_0095

Affected Products

Centos

Ghostscript

Red Hat

Suse

References · 27

• http://security.gentoo.org/glsa/glsa-201412-17.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4054 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4820 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-3743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3743 · Security Note
• https://linux.oracle.com/errata/ELSA-2012-0095.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2012-0095.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2055 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3743 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3743 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3743 · Vendor Advisory
• https://lists.centos.org/pipermail/centos-announce/2012-February/080581.html · Note
• http://securityfocus.com/archive/1/514892/100/0/threaded · Note
• http://securitytracker.com/id?1024785 · Note
• http://bugs.ghostscript.com/show_bug.cgi?id=691339 · Note