CVE-2009-0583
Summary
| CVE | CVE-2009-0583 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-03-23 20:00:00 UTC |
| Updated | 2023-02-13 01:17:00 UTC |
| Description | Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. |
Risk And Classification
Problem Types: CWE-119
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Argyllcms | Argyllcms | 0.1.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.1 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.2 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.3.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.6.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.7.0 | beta_8 | All | All |
| Application | Argyllcms | Argyllcms | 1.0.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 1.0.2 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.1.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.1 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.2.2 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.3.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.6.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 0.7.0 | beta_8 | All | All |
| Application | Argyllcms | Argyllcms | 1.0.0 | All | All | All |
| Application | Argyllcms | Argyllcms | 1.0.2 | All | All | All |
| Application | Argyllcms | Argyllcms | All | All | All | All |
| Application | Ghostscript | Ghostscript | 5.50 | All | All | All |
| Application | Ghostscript | Ghostscript | 7.05 | All | All | All |
| Application | Ghostscript | Ghostscript | 7.07 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.0.1 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.15 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.15.2 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.54 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.56 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.57 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.61 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.62 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.63 | All | All | All |
| Application | Ghostscript | Ghostscript | 5.50 | All | All | All |
| Application | Ghostscript | Ghostscript | 7.05 | All | All | All |
| Application | Ghostscript | Ghostscript | 7.07 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.0.1 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.15 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.15.2 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.54 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.56 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.57 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.61 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.62 | All | All | All |
| Application | Ghostscript | Ghostscript | 8.63 | All | All | All |
| Application | Ghostscript | Ghostscript | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Fedora update for argyllcms - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | www.redhat.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| [SECURITY] Fedora 10 Update: ghostscript-8.63-5.fc10 | FEDORA | www.redhat.com | Vendor Advisory |
| [SECURITY] Fedora 10 Update: argyllcms-1.0.3-3.fc10 | FEDORA | www.redhat.com | |
| SUSE Update for Multiple Packages - Advisories - Community | SECUNIA | secunia.com | Vendor Advisory |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| USN-743-1: Ghostscript vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Ghostscript icclib Multiple Vulnerabilities - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Gentoo Bug 261087 - app-text/ghostscript-* ICC Library integer overflows (CVE-2009-0583,CVE-2009-0584) | CONFIRM | bugs.gentoo.org | |
| Debian -- Security Information -- DSA-1746-1 ghostscript | DEBIAN | www.debian.org | Vendor Advisory |
| Gentoo Linux Documentation -- Ghostscript: User-assisted execution of arbitrary code | GENTOO | www.gentoo.org | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Gentoo update for ghostscript - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| [SECURITY] Fedora 9 Update: argyllcms-1.0.3-3.fc9 | FEDORA | www.redhat.com | |
| Sun Solaris Ghostscript Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| Webmail | OVH- OVH | VUPEN | www.vupen.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| Ubuntu update for ghostscript - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Bug 487742 – CVE-2009-0583 ghostscript, argyllcms: Multiple integer overflows in the International Color Consortium Format Library | CONFIRM | bugzilla.redhat.com | Vendor Advisory |
| Ghostscript Multiple Input Validation and Integer Overflow Vulnerabilities | BID | www.securityfocus.com | |
| Ghostscript Overflows in International Color Consortium Format Library Lets Users Execute Arbitrary Code - SecurityTracker | SECTRACK | securitytracker.com | |
| ASA-2009-098 (RHSA-2009-0345) | CONFIRM | support.avaya.com | |
| Red Hat update for ghostscript - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Ubuntu update for ghostscript - Advisories - Community | SECUNIA | secunia.com | |
| Debian update for ghostscript - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| AusCERT - ESB-2009.0259 -- [UNIX/Linux][RedHat] -- Moderate: ghostscript security update | AUSCERT | www.auscert.org.au | US Government Resource |
| Support / Security / Advisories / / MDVSA-2009:095 | Mandriva | MANDRIVA | www.mandriva.com | |
| Support / Security / Advisories / / MDVSA-2009:096 | Mandriva | MANDRIVA | www.mandriva.com | |
| Advisories:rPSA-2009-0050 - rPath Wiki | CONFIRM | wiki.rpath.com | Vendor Advisory |
| Fedora update for ghostscript - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| Sun Solaris 9 Ghostscript Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | |
| USN-757-1: Ghostscript vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | |
| Argyll Color Management System icclib Multiple Vulnerabilities - Advisories - Community | SECUNIA | secunia.com | Vendor Advisory |
| issues.rpath.com/browse/RPL-2991 | CONFIRM | issues.rpath.com | |
| [SECURITY] Fedora 9 Update: ghostscript-8.63-2.fc9 | FEDORA | www.redhat.com | Vendor Advisory |
| access.redhat.com | CVE-2009-0583 | MISC | access.redhat.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| 262288 | SUNALERT | sunsolve.sun.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:007 | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | MISC | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.