CVE-2009-0583

Executive Summary

Informations
Name	CVE-2009-0583	First vendor Publication	2009-03-23
Vendor	Cve	Last vendor Modification	2010-08-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0583

CWE : Common Weakness Enumeration

id	Name
CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10795

Oval ID:	oval:org.mitre.oval:def:10795
Title:	Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Description:	Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0583	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section hpijs is earlier than 0:7.05-32.1.17 AND ghostscript-devel is earlier than 0:7.05-32.1.17 AND ghostscript is earlier than 0:7.05-32.1.17 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ghostscript-devel is earlier than 0:7.07-33.2.el4_7.5 AND ghostscript is earlier than 0:7.07-33.2.el4_7.5 AND ghostscript-gtk is earlier than 0:7.07-33.2.el4_7.5 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ghostscript-devel is earlier than 0:8.15.2-9.4.el5_3.4 AND ghostscript is earlier than 0:8.15.2-9.4.el5_3.4 AND ghostscript-gtk is earlier than 0:8.15.2-9.4.el5_3.4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Argyllcms Argyllcms cpe:/a:argyllcms:argyllcms:1.0.3 cpe:/a:argyllcms:argyllcms:1.0.2 cpe:/a:argyllcms:argyllcms:1.0.0 cpe:/a:argyllcms:argyllcms:0.7.0:beta_8 cpe:/a:argyllcms:argyllcms:0.6.0 cpe:/a:argyllcms:argyllcms:0.3.0 cpe:/a:argyllcms:argyllcms:0.2.2 cpe:/a:argyllcms:argyllcms:0.2.1 cpe:/a:argyllcms:argyllcms:0.2.0 cpe:/a:argyllcms:argyllcms:0.1.0	10
Application	Ghostscript Ghostscript cpe:/a:ghostscript:ghostscript:8.64 cpe:/a:ghostscript:ghostscript:8.63 cpe:/a:ghostscript:ghostscript:8.62 cpe:/a:ghostscript:ghostscript:8.61 cpe:/a:ghostscript:ghostscript:8.57 cpe:/a:ghostscript:ghostscript:8.56 cpe:/a:ghostscript:ghostscript:8.54 cpe:/a:ghostscript:ghostscript:8.15.2 cpe:/a:ghostscript:ghostscript:8.15 cpe:/a:ghostscript:ghostscript:8.0.1 cpe:/a:ghostscript:ghostscript:7.07 cpe:/a:ghostscript:ghostscript:7.05 cpe:/a:ghostscript:ghostscript:5.50	13

Open Source Vulnerability Database (OSVDB)

id	Description
53255	International Color Consortium (ICC) Format library (icclib) icc.c Crafted Im...

Internal Sources (Detail)

Source	Url
AUSCERT	http://www.auscert.org.au/render.html?it=10666
BID	http://www.securityfocus.com/bid/34184
BUGTRAQ	http://www.securityfocus.com/archive/1/archive/1/501994/100/0/threaded
CONFIRM	http://bugs.gentoo.org/show_bug.cgi?id=261087 http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050 https://bugzilla.redhat.com/show_bug.cgi?id=487742 https://issues.rpath.com/browse/RPL-2991
DEBIAN	http://www.debian.org/security/2009/dsa-1746
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00770.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00772.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00887.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00916.html
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200903-37.xml
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:095 http://www.mandriva.com/security/advisories?name=MDVSA-2009:096
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-0345.html
SECTRACK	http://securitytracker.com/id?1021868
SECUNIA	http://secunia.com/advisories/34266 http://secunia.com/advisories/34373 http://secunia.com/advisories/34381 http://secunia.com/advisories/34393 http://secunia.com/advisories/34398 http://secunia.com/advisories/34418 http://secunia.com/advisories/34437 http://secunia.com/advisories/34443 http://secunia.com/advisories/34469 http://secunia.com/advisories/34729 http://secunia.com/advisories/35559 http://secunia.com/advisories/35569
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
UBUNTU	http://www.ubuntu.com/usn/USN-743-1 http://www.ubuntulinux.org/support/documentation/usn/usn-757-1
VUPEN	http://www.vupen.com/english/advisories/2009/0776 http://www.vupen.com/english/advisories/2009/0777 http://www.vupen.com/english/advisories/2009/0816 http://www.vupen.com/english/advisories/2009/1708
XF	http://xforce.iss.net/xforce/xfdb/49329

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:44:26	Multiple Updates

Type	Count
Oval ID(s)	1
CPE ID(s)	23
osvdb(s)	1

Related	Severity
MDVSA-2009:311	(Critical)
USN-757-1	(Critical)
USN-743-1	(Critical)
SUN-262288	(Critical)
RHSA-2009:0421	(Critical)
RHSA-2009:0420	(Critical)
RHSA-2009:0345	(Critical)
MDVSA-2009:096-1	(Critical)
MDVSA-2009:096	(Critical)
MDVSA-2009:095	(Critical)
GLSA-200903-37	(Critical)
DSA-1746	(Critical)