icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library (icclib). Using specially crafted ICC profiles, an attacker could create a malicious PostScript or PDF file with embedded images which could cause Ghostscript to crash or, potentially, execute arbitrary code when opened by the victim.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0345 advisory.

    [8.15.2-9.4:.4]
    - Avoid dividing by zero while checking for integer overflows.

    [8.15.2-9.4:.1]
    - Applied patch to fix CVE-2009-0583 (bug #487742) and       CVE-2009-0584 (bug #487744).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library (icclib). Using specially crafted ICC profiles, an attacker could create a malicious PostScript or PDF file with embedded images which could cause Ghostscript to crash, or, potentially, execute arbitrary code when opened by the victim. (CVE-2009-0583, CVE-2009-0584)

Multiple security vulnerabilities has been identified and fixed in ghostscript :

A buffer underflow in Ghostscript's CCITTFax decoding filter allows remote attackers to cause denial of service and possibly to execute arbitrary by using a crafted PDF file (CVE-2007-6725).

Buffer overflow in Ghostscript's BaseFont writer module allows remote attackers to cause a denial of service and possibly to execute arbitrary code via a crafted Postscript file (CVE-2008-6679).

Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images (CVE-2009-0583, CVE-2009-0584).

Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images. Note: this issue exists because of an incomplete fix for CVE-2009-0583 (CVE-2009-0792).

Heap-based overflow in Ghostscript's JBIG2 decoding library allows attackers to cause denial of service and possibly to execute arbitrary code by using a crafted PDF file (CVE-2009-0196).

Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).

Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).

Previousely the ghostscript packages were statically built against a bundled and private copy of the jasper library. This update makes ghostscript link against the shared system jasper library which makes it easier to address presumptive future security issues in the jasper library.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides fixes for that vulnerabilities.

Integer overflows and missing upper bounds checks in Ghostscript's ICC library potentially allowed attackers to crash Ghostscript or even cause execution of arbitrary code via specially crafted PS or PDF files. (CVE-2009-0583 / CVE-2009-0584)

Integer overflows and missing upper bounds checks in Ghostscript's ICC library potentially allowed attackers to crash Ghostscript or even cause execution of arbitrary code via specially crafted PS or PDF files. (CVE-2009-0583, CVE-2009-0584)

Integer overflows and missing upper bounds checks in Ghostscript's ICC library potentially allowed attackers to crash Ghostscript or even cause execution of arbitrary code via specially crafted PS or PDF files (CVE-2009-0583, CVE-2009-0584).

New ghostscript packages are available for Slackware 12.1, 12.2, and
-current to fix security issues.

A buffer underflow in Ghostscript's CCITTFax decoding filter allows remote attackers to cause denial of service and possibly to execute arbitrary by using a crafted PDF file (CVE-2007-6725).

Buffer overflow in Ghostscript's BaseFont writer module allows remote attackers to cause a denial of service and possibly to execute arbitrary code via a crafted Postscript file (CVE-2008-6679).

Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images (CVE-2009-0583, CVE-2009-0584).

Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images. Note: this issue exists because of an incomplete fix for CVE-2009-0583 (CVE-2009-0792).

Heap-based overflow in Ghostscript's JBIG2 decoding library allows attackers to cause denial of service and possibly to execute arbitrary code by using a crafted PDF file (CVE-2009-0196).

This update provides fixes for that vulnerabilities.

Update :

gostscript packages from Mandriva Linux 2009.0 distribution are not affected by CVE-2007-6725.

Security update for integer overflows (CVE-2009-0583) and upper bounds checks (CVE-2009-0584) in the ICC profile handling.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Ghostscript contained a buffer underflow in its CCITTFax decoding filter. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2007-6725)

It was discovered that Ghostscript contained a buffer overflow in the BaseFont writer module. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2008-6679)

It was discovered that Ghostscript contained additional integer overflows in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript or PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0792)

Alin Rad Pop discovered that Ghostscript contained a buffer overflow in the jbig2dec library. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0196)

USN-743-1 provided updated ghostscript and gs-gpl packages to fix two security vulnerabilities. This update corrects the same vulnerabilities in the gs-esp package.

It was discovered that Ghostscript contained multiple integer overflows in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0583)

It was discovered that Ghostscript did not properly perform bounds checking in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0584).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflows were found in the International Color Consortium Format Library (icclib). An attacker could use this flaw to potentially execute arbitrary code by requesting to translate a specially- crafted image file created on one device into another's device native color space via a device file.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Ghostscript contained multiple integer overflows in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0583)

It was discovered that Ghostscript did not properly perform bounds checking in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2009-0584).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-37 (Ghostscript: User-assisted execution of arbitrary code)

    Jan Lieskovsky from the Red Hat Security Response Team discovered the     following vulnerabilities in Ghostscript's ICC Library:
    Multiple integer overflows (CVE-2009-0583).
    Multiple     insufficient bounds checks on certain variable sizes     (CVE-2009-0584).
  Impact :

    A remote attacker could entice a user to open a specially crafted     PostScript file containing images and a malicious ICC profile, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application.
  Workaround :

    There is no known workaround at this time.

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ghostscript is a set of software that provides a PostScript(TM) interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library (icclib). Using specially crafted ICC profiles, an attacker could create a malicious PostScript or PDF file with embedded images which could cause Ghostscript to crash, or, potentially, execute arbitrary code when opened by the victim. (CVE-2009-0583, CVE-2009-0584)

All users of ghostscript are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

Two security issues have been discovered in ghostscript, the GPL Ghostscript PostScript/PDF interpreter. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0583     Jan Lieskovsky discovered multiple integer overflows in     the ICC library, which allow the execution of arbitrary     code via crafted ICC profiles in PostScript files with     embedded images.

  - CVE-2009-0584     Jan Lieskovsky discovered insufficient upper-bounds     checks on certain variable sizes in the ICC library,     which allow the execution of arbitrary code via crafted     ICC profiles in PostScript files with embedded images.

ID	Name	Product	Family	Severity
78232	F5 Networks BIG-IP : icclib vulnerabilities (SOL9990)	Nessus	F5 Networks Local Security Checks	high
67823	Oracle Linux 5 : ghostscript (ELSA-2009-0345)	Nessus	Oracle Linux Local Security Checks	critical
60549	Scientific Linux Security Update : ghostscript on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
42997	Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:311)	Nessus	Mandriva Local Security Checks	critical
41512	SuSE 10 Security Update : Ghostscript (ZYPP Patch Number 6066)	Nessus	SuSE Local Security Checks	high
41394	SuSE 11 Security Update : Ghostscript (SAT Patch Number 636)	Nessus	SuSE Local Security Checks	high
41285	SuSE9 Security Update : Ghostscript (YOU Patch Number 12375)	Nessus	SuSE Local Security Checks	high
40219	openSUSE Security Update : ghostscript-devel (ghostscript-devel-592)	Nessus	SuSE Local Security Checks	high
39967	openSUSE Security Update : ghostscript-devel (ghostscript-devel-592)	Nessus	SuSE Local Security Checks	high
39567	Slackware 12.1 / 12.2 / current : ghostscript (SSA:2009-181-01)	Nessus	Slackware Local Security Checks	high
38164	Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:095)	Nessus	Mandriva Local Security Checks	high
37905	Fedora 10 : ghostscript-8.63-5.fc10 (2009-2885)	Nessus	Fedora Local Security Checks	high
37438	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : ghostscript, gs-esp, gs-gpl vulnerabilities (USN-757-1)	Nessus	Ubuntu Local Security Checks	high
37323	Fedora 10 : argyllcms-1.0.3-3.fc10 (2009-3011)	Nessus	Fedora Local Security Checks	high
36471	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : ghostscript, gs-gpl vulnerabilities (USN-743-1)	Nessus	Ubuntu Local Security Checks	high
36024	Fedora 9 : argyllcms-1.0.3-3.fc9 (2009-3031)	Nessus	Fedora Local Security Checks	high
36004	openSUSE 10 Security Update : ghostscript-devel (ghostscript-devel-6065)	Nessus	SuSE Local Security Checks	high
36003	GLSA-200903-37 : Ghostscript: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
35983	Fedora 9 : ghostscript-8.63-2.fc9 (2009-2883)	Nessus	Fedora Local Security Checks	high
35972	RHEL 3 / 4 / 5 : ghostscript (RHSA-2009:0345)	Nessus	Red Hat Local Security Checks	high
35968	Debian DSA-1746-1 : ghostscript - several vulnerabilities	Nessus	Debian Local Security Checks	high
35966	CentOS 3 / 4 : ghostscript (CESA-2009:0345)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2009-0584

critical

Tenable Plugins

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high