CVE-2009-0584: Critical severity Argyllcms Cms vulnerability
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Other sources
Multiple insufficient upper-bounds checks on certain sizes were found in the Ghostscript's International Color Consortium Format Library (icclib). An attacker could use this flaw to potentially execute arbitrary code by providing a specially-crafted image file for processing via the Ghotstscript's device file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0584?
CVE-2009-0584 has a severity rating that indicates it can lead to denial of service and potentially execute arbitrary code.
How do I fix CVE-2009-0584?
To fix CVE-2009-0584, update to versions of Ghostscript later than 8.64 and Argyll CMS versions later than 1.0.3.
What software is affected by CVE-2009-0584?
CVE-2009-0584 affects Ghostscript versions up to 8.64 and Argyll Color Management System versions up to 1.0.3.
Can CVE-2009-0584 be exploited remotely?
Yes, CVE-2009-0584 can be exploited by context-dependent attackers, potentially leading to a crash or arbitrary code execution.
Is there a patch available for CVE-2009-0584?
Yes, users should apply patches provided in the latest releases of the affected software to mitigate CVE-2009-0584.