Vulnerability Details : CVE-2009-0792
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2009-0792
- cpe:2.3:a:ghostscript:ghostscript:*:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.61:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.62:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.63:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.56:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.54:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:8.57:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:5.50:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:7.07:*:*:*:*:*:*:*
- cpe:2.3:a:ghostscript:ghostscript:7.05:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:*:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.7.0:beta_8:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:argyllcms:argyllcms:0.1.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-0792
1.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-0792
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2009-0792
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-0792
-
http://www.redhat.com/support/errata/RHSA-2009-0420.html
Support
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/50381
Ghostscript icc.c buffer overflow CVE-2009-0792 Vulnerability Report
-
http://www.securityfocus.com/archive/1/502757/100/0/threaded
-
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00211.html
[SECURITY] Fedora 9 Update: argyllcms-1.0.3-4.fc9
-
https://bugzilla.redhat.com/show_bug.cgi?id=491853
491853 – (CVE-2009-0792) CVE-2009-0792 ghostscript, argyllcms: Incomplete fix for CVE-2009-0583
-
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:011 - openSUSE Security Announce - openSUSE Mailing Lists
-
http://support.avaya.com/elmodocs2/security/ASA-2009-155.htm
ASA-2009-155 (RHSA-2009-0420)
-
http://www.vupen.com/english/advisories/2009/1708
Site en construction
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11207
404 Not Found
-
https://usn.ubuntu.com/757-1/
404: Page not found | Ubuntu
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:096
Mandriva
-
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00460.html
[SECURITY] Fedora 10 Update: ghostscript-8.63-6.fc10
-
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00217.html
[SECURITY] Fedora 10 Update: argyllcms-1.0.3-4.fc10
-
http://www.redhat.com/support/errata/RHSA-2009-0421.html
Support
-
http://wiki.rpath.com/Advisories:rPSA-2009-0060
-
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00461.html
[SECURITY] Fedora 9 Update: ghostscript-8.63-3.fc9
-
http://security.gentoo.org/glsa/glsa-201412-17.xml
GPL Ghostscript: Multiple vulnerabilities (GLSA 201412-17) — Gentoo security
-
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:009 - openSUSE Security Announce - openSUSE Mailing Lists
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:095
Mandriva
Jump to