CVE-2007-6725 The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF....
HighCVSS 7.5
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ghostscript | = 8.61 | No fix listed |
| debian/ghostscript(Debian:12) | < 8.63.dfsg.1-1 | 8.63.dfsg.1-1 |
| debian/ghostscript(Debian:13) | < 8.63.dfsg.1-1 | 8.63.dfsg.1-1 |
| debian/ghostscript(Debian:14) | < 8.63.dfsg.1-1 | 8.63.dfsg.1-1 |
References
- SUSE-SR:2009:011 vendor-advisory
- 34726 third-party-advisory
- 34729 third-party-advisory
- 34732 third-party-advisory
- 35416 third-party-advisory
- 35559 third-party-advisory
- 35569 third-party-advisory
- 262288 vendor-advisory
- support.avaya.com
- wiki.rpath.com
- FEDORA-2008-5699 vendor-advisory
- MDVSA-2009:095 vendor-advisory
- MDVSA-2009:096 vendor-advisory
- [oss-security] 20090401 CVE request -- ghostscript mailing-list
- RHSA-2009:0420 vendor-advisory
- RHSA-2009:0421 vendor-advisory
- 20090417 rPSA-2009-0060-1 ghostscript mailing-list
- 34337 vdb-entry
- ADV-2009-1708 vdb-entry
- bugzilla.redhat.com exploit
- bugzilla.redhat.com exploit
- oval:org.mitre.oval:def:9507 signature vdb-entry
- USN-757-1 vendor-advisory
- Debian Security Tracker CVE-2007-6725 vendor-advisory
- bugs.debian.org issue-tracking