REDHAT-BUG-582300: Buffer Overflow
First published: Wed Apr 14 2010(Updated: )
A buffer overflow vulnerability in Ghostscript's parser function was reported. A specially crafted postscript file could result in the execution of arbitrary code if opened or printed (i.e. via CUPS). Note that stack protections in the compiler render this into nothing more than a denial of service. This has been corrected in upstream Ghostscript 8.71; at least 8.64 and 8.70 are affected by this issue. Testing of Ghostscript 8.15 shows it does not suffer from this flaw. Acknowledgements: Red Hat would like to thank Rodrigo Rubira Branco of Check Point Vulnerability Discovery Team for responsibly reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Artifex Ghostscript | >=8.64<8.71 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-582300?
The severity of REDHAT-BUG-582300 is primarily classified as a denial of service due to the buffer overflow vulnerability.
How do I fix REDHAT-BUG-582300?
To fix REDHAT-BUG-582300, update Ghostscript to a version later than 8.71 where this vulnerability has been addressed.
What systems are affected by REDHAT-BUG-582300?
REDHAT-BUG-582300 affects Ghostscript versions between 8.64 and 8.71.
What can be exploited with REDHAT-BUG-582300?
REDHAT-BUG-582300 can be exploited by opening or printing a specially crafted PostScript file, potentially leading to arbitrary code execution.
Who is the vendor of the software related to REDHAT-BUG-582300?
The vendor of the software related to REDHAT-BUG-582300 is Artifex Software, which develops Ghostscript.
- collector/redhat-bugzilla
- alias/CVE-2010-1869
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ghostscript
- canonical/artifex ghostscript