CVE-2009-0583: Buffer Overflow
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Other sources
Multiple integer overflows were found in the Ghostsript's International Color Consortium Format Library (icclib). An attacker could use this flaw to potentially execute arbitrary code by requesting to translate a specially- crafted image file created on one device into another's device native color space via a device file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0583?
CVE-2009-0583 has a moderate severity rating as it can lead to denial of service via heap-based buffer overflow.
How do I fix CVE-2009-0583?
To fix CVE-2009-0583, you should update Ghostscript or Argyll Color Management System to versions that are patched against this vulnerability.
What software is affected by CVE-2009-0583?
CVE-2009-0583 affects Ghostscript versions up to 8.64 and Argyll Color Management System versions up to 1.0.3.
What type of vulnerability is CVE-2009-0583?
CVE-2009-0583 is classified as an integer overflow vulnerability that can cause heap-based buffer overflows.
Who are the potential attackers for CVE-2009-0583?
CVE-2009-0583 can be exploited by context-dependent attackers who can leverage the vulnerability to crash the affected software.