CVE-2012-4405 Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remot...
MediumCVSS 6.8
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/argyll(Debian:12) | < 1.4.0-7 | 1.4.0-7 |
| debian/argyll(Debian:13) | < 1.4.0-7 | 1.4.0-7 |
| debian/argyll(Debian:14) | < 1.4.0-7 | 1.4.0-7 |
| debian/ghostscript(Debian:12) | < 9.05~dfsg-6.1 | 9.05~dfsg-6.1 |
| debian/ghostscript(Debian:13) | < 9.05~dfsg-6.1 | 9.05~dfsg-6.1 |
| debian/ghostscript(Debian:14) | < 9.05~dfsg-6.1 | 9.05~dfsg-6.1 |
| argyllcms cms | All versions | No fix listed |
| color icclib | All versions | No fix listed |
| ghostscript | = 9.06 | No fix listed |
References
- Debian Security Tracker CVE-2012-4405 vendor-advisory
- SUSE-SU-2012:1222 vendor-advisory
- openSUSE-SU-2012:1289 vendor-advisory
- openSUSE-SU-2012:1290 vendor-advisory
- RHSA-2012:1256 vendor-advisory
- 50719 third-party-advisory
- GLSA-201412-17 vendor-advisory
- MDVSA-2012:151 vendor-advisory
- MDVSA-2013:089 vendor-advisory
- MDVSA-2013:090 vendor-advisory
- [oss-security] 20120911 CVE-2012-4405 ghostscript, argyllcms: Array index error leading to heap-based bufer OOB write mailing-list
- 55494 vdb-entry
- 1027517 vdb-entry
- USN-1581-1 vendor-advisory
- icclib-pdf-bo(78411) vdb-entry
- wiki.mageia.org
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking