CVE-2008-0411

Exploit

EPSS 14.41%
Veröffentlicht 28.02.2008 21:44:00
Zuletzt bearbeitet 16.06.2026 22:49:33
Erkennungen
Login

Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 30

NVD 4 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ghostscript ≫ Ghostscript Version <= 8.61

   Debian ≫ Debian Linux Version 3.1
   Debian ≫ Debian Linux Version 3.1 Edition alpha
   Debian ≫ Debian Linux Version 3.1 Edition amd64
   Debian ≫ Debian Linux Version 3.1 Edition arm
   Debian ≫ Debian Linux Version 3.1 Edition hppa
   Debian ≫ Debian Linux Version 3.1 Edition ia-32
   Debian ≫ Debian Linux Version 3.1 Edition ia-64
   Debian ≫ Debian Linux Version 3.1 Edition m68k
   Debian ≫ Debian Linux Version 3.1 Edition mips
   Debian ≫ Debian Linux Version 3.1 Edition mipsel
   Debian ≫ Debian Linux Version 3.1 Edition ppc
   Debian ≫ Debian Linux Version 3.1 Edition s-390
   Debian ≫ Debian Linux Version 3.1 Edition sparc
   Debian ≫ Debian Linux Version 4.0
   Debian ≫ Debian Linux Version 4.0 Edition alpha
   Debian ≫ Debian Linux Version 4.0 Edition amd64
   Debian ≫ Debian Linux Version 4.0 Edition arm
   Debian ≫ Debian Linux Version 4.0 Edition hppa
   Debian ≫ Debian Linux Version 4.0 Edition ia-32
   Debian ≫ Debian Linux Version 4.0 Edition ia-64
   Debian ≫ Debian Linux Version 4.0 Edition m68k
   Debian ≫ Debian Linux Version 4.0 Edition mips
   Debian ≫ Debian Linux Version 4.0 Edition mipsel
   Debian ≫ Debian Linux Version 4.0 Edition powerpc
   Debian ≫ Debian Linux Version 4.0 Edition s-390
   Debian ≫ Debian Linux Version 4.0 Edition sparc
   Mandrakesoft ≫ Mandrake Linux Version 2007
   Mandrakesoft ≫ Mandrake Linux Version 2007.0_x86_64
   Mandrakesoft ≫ Mandrake Linux Version 2007.1
   Mandrakesoft ≫ Mandrake Linux Version 2007.1 Edition x86_64
   Mandrakesoft ≫ Mandrake Linux Version 2008.0
   Mandrakesoft ≫ Mandrake Linux Version 2008.0 Edition x86_64
   Mandrakesoft ≫ Mandrake Linux Corporate Server Version 3.0
   Mandrakesoft ≫ Mandrake Linux Corporate Server Version 4.0
   Mandrakesoft ≫ Mandrakesoft Corporate Server Version 3.0_x86_64
   Mandrakesoft ≫ Mandrakesoft Corporate Server Version 4.0_x86_64
   Redhat ≫ Desktop Version 3.0
   Redhat ≫ Desktop Version 4.0
   Redhat ≫ Enterprise Linux Version 5 Edition server
   Redhat ≫ Enterprise Linux Version as_3
   Redhat ≫ Enterprise Linux Version as_4
   Redhat ≫ Enterprise Linux Version es_3
   Redhat ≫ Enterprise Linux Version es_4
   Redhat ≫ Enterprise Linux Version ws_3
   Redhat ≫ Enterprise Linux Version ws_4
   Redhat ≫ Enterprise Linux Desktop Version 5 Edition client
   Redhat ≫ Enterprise Linux Desktop Workstation Version 5 Edition client
   Rpath ≫ Rpath Linux Version 1
   Suse ≫ Novell Linux Pos Version 9
   Suse ≫ Open Suse Version 10.2
   Suse ≫ Open Suse Version 10.3
   Suse ≫ Suse Linux Version 9.0 Edition enterprise_server
   Suse ≫ Suse Linux Version 10 Update sp1 Edition enterprise_desktop
   Suse ≫ Suse Linux Version 10 Update sp1 Edition enterprise_server
   Suse ≫ Suse Linux Version 10.1 Edition ppc
   Suse ≫ Suse Linux Version 10.1 Edition x86
   Suse ≫ Suse Linux Version 10.1 Edition x86_64
   Suse ≫ Suse Open Enterprise Server Version 0

Ghostscript ≫ Ghostscript Version 0

Ghostscript ≫ Ghostscript Version 8.0.1

Ghostscript ≫ Ghostscript Version 8.15

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	14.41%	0.962

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00009.html

Third Party Advisory

Mailing List

http://scary.beasts.org/security/CESA-2008-001.html

Exploit

http://secunia.com/advisories/29101

URL Repurposed

http://secunia.com/advisories/29103

URL Repurposed

http://secunia.com/advisories/29112

URL Repurposed

http://secunia.com/advisories/29135

URL Repurposed

http://secunia.com/advisories/29147

URL Repurposed

http://secunia.com/advisories/29154

URL Repurposed

http://secunia.com/advisories/29169

URL Repurposed

http://secunia.com/advisories/29196

URL Repurposed

http://secunia.com/advisories/29314

URL Repurposed

http://secunia.com/advisories/29768

URL Repurposed

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.370633

Mailing List

http://wiki.rpath.com/Advisories:rPSA-2008-0082

Broken Link

http://www.debian.org/security/2008/dsa-1510

Patch

http://www.gentoo.org/security/en/glsa/glsa-200803-14.xml

Patch

http://www.mandriva.com/security/advisories?name=MDVSA-2008:055

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0155.html

URL Repurposed

http://www.securityfocus.com/archive/1/488932/100/0/threaded

Broken Link

VDB Entry

http://www.securityfocus.com/archive/1/488946/100/0/threaded

Broken Link

VDB Entry

http://www.securityfocus.com/bid/28017

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id?1019511

Third Party Advisory

VDB Entry

http://www.ubuntu.com/usn/usn-599-1

Third Party Advisory

http://www.vupen.com/english/advisories/2008/0693/references

Not Applicable

https://issues.rpath.com/browse/RPL-2217

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9557

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00085.html

Third Party Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2008-0411

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-0411

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-0411

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2008-0411