CVE-2010-1869: Buffer Overflow
A buffer overflow vulnerability in Ghostscript's parser function was reported. A specially crafted postscript file could result in the execution of arbitrary code if opened or printed (i.e. via CUPS). Note that stack protections in the compiler render this into nothing more than a denial of service. This has been corrected in upstream Ghostscript 8.71; at least 8.64 and 8.70 are affected by this issue. Testing of Ghostscript 8.15 shows it does not suffer from this flaw.
Acknowledgements:
Red Hat would like to thank Rodrigo Rubira Branco of Check Point Vulnerability Discovery Team for responsibly reporting this issue.
Other sources
Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1869?
CVE-2010-1869 is considered a high severity vulnerability due to the potential for arbitrary code execution resulting from a buffer overflow.
How do I fix CVE-2010-1869?
To mitigate CVE-2010-1869, update Ghostscript to version 8.71 or later, which addresses this vulnerability.
Which versions of Ghostscript are affected by CVE-2010-1869?
CVE-2010-1869 affects Ghostscript versions 8.64 and 8.70.
What happens if CVE-2010-1869 is exploited?
Exploitation of CVE-2010-1869 could lead to execution of arbitrary code, although in many cases it may result in denial of service due to stack protections.
How is CVE-2010-1869 typically exploited?
CVE-2010-1869 is typically exploited by opening or printing a specially crafted PostScript file.