9.3

CVE-2009-0196

Exploit
Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ghostscript ≫ Ghostscript Version <= 8.64
Ghostscript ≫ Ghostscript Version0
Ghostscript ≫ Ghostscript Version5.50
Ghostscript ≫ Ghostscript Version7.07
Ghostscript ≫ Ghostscript Version8.0.1
Ghostscript ≫ Ghostscript Version8.15
Ghostscript ≫ Ghostscript Version8.15.2
Ghostscript ≫ Ghostscript Version8.54
Ghostscript ≫ Ghostscript Version8.56
Ghostscript ≫ Ghostscript Version8.57
Ghostscript ≫ Ghostscript Version8.60
Ghostscript ≫ Ghostscript Version8.61
Ghostscript ≫ Ghostscript Version8.62
Ghostscript ≫ Ghostscript Version8.63
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.37% 0.936
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://secunia.com/advisories/35416
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
http://secunia.com/advisories/34729
http://secunia.com/advisories/35559
http://secunia.com/advisories/35569
http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
http://www.mandriva.com/security/advisories?name=MDVSA-2009:095
http://www.vupen.com/english/advisories/2009/1708
https://usn.ubuntu.com/757-1/
http://secunia.com/advisories/34732
http://wiki.rpath.com/Advisories:rPSA-2009-0060
http://www.redhat.com/support/errata/RHSA-2009-0421.html
http://www.securityfocus.com/archive/1/502757/100/0/threaded
http://secunia.com/advisories/34667
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00460.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00461.html
http://security.gentoo.org/glsa/glsa-201412-17.xml
http://osvdb.org/53492
Exploit
http://secunia.com/advisories/34292
Vendor Advisory
http://secunia.com/secunia_research/2009-21/
Vendor Advisory
http://www.securityfocus.com/archive/1/502586/100/0/threaded
http://www.securityfocus.com/bid/34445
Patch
http://www.securitytracker.com/id?1022029
http://www.vupen.com/english/advisories/2009/0983
Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=337747
Exploit
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10533