Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2010:102 | First vendor Publication | 2010-05-19 |
| Vendor | Mandriva | Last vendor Modification | 2010-05-19 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability has been found and corrected in ghostscript: Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file (CVE-2010-1869). Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products. The updated packages have been patched to correct this issue. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2010:102 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12750 | |||
| Oval ID: | oval:org.mitre.oval:def:12750 | ||
| Title: | USN-961-1 -- ghostscript vulnerabilities | ||
| Description: | David Srbecky discovered that Ghostscript incorrectly handled debug logging. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.04 and Ubuntu 9.10. The default compiler options for affected releases should reduce the vulnerability to a denial of service. It was discovered that Ghostscript incorrectly handled certain malformed files. If a user or automated system were tricked into opening a crafted Postscript or PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and Ubuntu 9.04. Dan Rosenberg discovered that Ghostscript incorrectly handled certain recursive Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Rodrigo Rubira Branco and Dan Rosenberg discovered that Ghostscript incorrectly handled certain malformed Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10 | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-961-1 CVE-2009-4270 CVE-2009-4897 CVE-2010-1628 CVE-2010-1869 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 | Product(s): | ghostscript |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-08-21 | Name : Debian Security Advisory DSA 2080-1 (ghostscript) File : nvt/deb_2080_1.nasl |
| 2010-07-16 | Name : Ubuntu Update for ghostscript vulnerabilities USN-961-1 File : nvt/gb_ubuntu_USN_961_1.nasl |
| 2010-05-28 | Name : Mandriva Update for ghostscript MDVSA-2010:102 (ghostscript) File : nvt/gb_mandriva_MDVSA_2010_102.nasl |
| 2010-05-19 | Name : Ghostscript Parser Buffer Overflow Vulnerabilities (Win) File : nvt/gb_ghostscript_parser_bof_vuln_win.nasl |
| 2010-03-22 | Name : Mandriva Update for mandriva-release MDVA-2010:102 (mandriva-release) File : nvt/gb_mandriva_MDVA_2010_102.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 64543 | GhostScript PostScript File Long Identifier Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ghostscript-devel-100712.nasl - Type : ACT_GATHER_INFO |
| 2010-08-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2080.nasl - Type : ACT_GATHER_INFO |
| 2010-08-03 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_ghostscript-devel-100712.nasl - Type : ACT_GATHER_INFO |
| 2010-08-03 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_ghostscript-devel-100712.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_ghostscript-devel-100712.nasl - Type : ACT_GATHER_INFO |
| 2010-07-14 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-961-1.nasl - Type : ACT_GATHER_INFO |
| 2010-05-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-102.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:41:29 |
|
