Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file, as originally reported for debug logging code in gdevcups.c in the CUPS output driver.

The remote host is affected by the vulnerability described in GLSA-201412-17 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF using GPL Ghostscript, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ghostscript fixes the following security issues :

  - Specially crafted postscript (.ps) files can cause     buffer overflows in ghostscript that could potentially     be exploited to execute arbitrary code. (CVE-2010-1869 /     CVE-2010-1628 / CVE-2009-4270)

  - By default, ghostscript reads certain initialization     files from the current working directory. Local     attackers could potentially exploit this to have other     users execute arbitrary commands by placing such files,     e.g. in /tmp. (CVE-2010-2055)

Specially crafted postscript (.ps) files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code (CVE-2010-1628, CVE-2010-1869, CVE-2009-4270)

ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g.
in /tmp (CVE-2010-2055).

Several security issues have been discovered in Ghostscript, a GPL PostScript/PDF interpreter, which might lead to the execution of arbitrary code if a user processes a malformed PDF or Postscript file.

Multiple vulnerabilities has been found and corrected in ghostscript :

Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file, as originally reported for debug logging code in gdevcups.c in the CUPS output driver (CVE-2009-4270).

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name (CVE-2009-4897).

Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter (CVE-2010-1628).

As a precaution ghostscript has been rebuilt to link against the system libpng library which was fixed with MDVSA-2010:133

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

David Srbecky discovered that Ghostscript incorrectly handled debug logging. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.04 and Ubuntu 9.10. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2009-4270)

It was discovered that Ghostscript incorrectly handled certain malformed files. If a user or automated system were tricked into opening a crafted Postscript or PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and Ubuntu 9.04. (CVE-2009-4897)

Dan Rosenberg discovered that Ghostscript incorrectly handled certain recursive Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2010-1628)

Rodrigo Rubira Branco and Dan Rosenberg discovered that Ghostscript incorrectly handled certain malformed Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2010-1869).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79970	GLSA-201412-17 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50909	SuSE 11 / 11.1 Security Update : ghostscript (SAT Patch Numbers 2708 / 2709)	Nessus	SuSE Local Security Checks	high
48236	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	high
48233	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	high
48223	Debian DSA-2080-1 : ghostscript - several vulnerabilities	Nessus	Debian Local Security Checks	critical
48193	Mandriva Linux Security Advisory : ghostscript (MDVSA-2010:134)	Nessus	Mandriva Local Security Checks	high
47815	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-1)	Nessus	SuSE Local Security Checks	high
47734	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : ghostscript vulnerabilities (USN-961-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2009-4270

high

Tenable Plugins

high

high

high

high

critical

high

high

high