PT-2011-1401 · Abcm2Ps+1 · Abcm2Ps+1

Published 2011-02-18 · Updated 2020-08-14 · CVE-2010-3441

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions abcm2ps versions prior to 5.9.12

Description The issue is related to multiple buffer overflows that could allow remote attackers to execute arbitrary code. This can be achieved through a crafted input file related to the PUT0 and PUT1 output macros, or a crafted input file related to the trim title function. Additionally, a long -O option on a command line might also be a potential attack vector.

Recommendations For versions prior to 5.9.12, update to version 5.9.12 or later to resolve the issue. As a temporary workaround, consider restricting the use of the PUT0 and PUT1 output macros, and the trim title function, until a patch is available. Avoid using long -O options on the command line until the issue is resolved.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2014-2245

CVE-2010-3441

Affected Products

Alt Linux

Abcm2Ps

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3441 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3441 · Security Note
• http://openwall.com/lists/oss-security/2010/04/08/5 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-3441 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4744 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054015.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3441 · Security Note
• http://openwall.com/lists/oss-security/2010/04/08/6 · Patch
• https://osv.dev/vulnerability/CVE-2010-3441 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4743 · Security Note
• http://openwall.com/lists/oss-security/2010/04/08/7 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=580435 · Patch
• https://errata.altlinux.org/ALT-PU-2014-2245 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577014 · Note
• http://securityfocus.com/bid/39271 · Note