Description
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | argyll | 1.0.3-2 | — |
| Debian 14 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 13 | argyll | 1.0.3-2 | — |
| Debian 13 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 12 | argyll | 1.0.3-2 | — |
| Debian 12 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 6.0 | ghostscript | 8.64~dfsg-1+squeeze1 | DTSA-198-1 |
| Debian 5.0 | ghostscript | 8.62.dfsg.1-3.2lenny1 | DSA-1746-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | gs-gpl | 8.54.dfsg.1-5etch2 | DSA-1746-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ghostscript +2 | 8.15.2-9.4.el5_3.4 | RHSA-2009:0345 |
| RHEL 4 | ghostscript +2 | 7.07-33.2.el4_7.5 | RHSA-2009:0345 |
| RHEL 3 | ghostscript +1 | 7.05-32.1.17 | RHSA-2009:0345 |
| RHEL 3 | hpijs | 1.3-32.1.17 | RHSA-2009:0345 |
Advisories 3
- RHSA-2009:0345 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1746-1 ghostscript gs-gpl - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-198-1 ghostscript - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34381 third-party-advisory
- SUSE-SR:2009:007 vendor-advisory
- 34437 third-party-advisory
- 34393 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm
- GLSA-200903-37 vendor-advisory
- 1021868 vdb-entry
- 34266 third-party-advisory
- 34443 third-party-advisory
- FEDORA-2009-3031 vendor-advisory
- DSA-1746 vendor-advisory
- ESB-2009.0259 third-party-advisory
- ADV-2009-0776 vdb-entry
- FEDORA-2009-2885 vendor-advisory
- 262288 vendor-advisory
- FEDORA-2009-3011 vendor-advisory
- 34418 third-party-advisory
- 34729 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050
- https://issues.rpath.com/browse/RPL-2991
- oval:org.mitre.oval:def:10795 vdb-entry signature
- MDVSA-2009:095 vendor-advisory
- ADV-2009-0816 vdb-entry
- 34469 third-party-advisory
- 35569 third-party-advisory
- ADV-2009-1708 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=487742
- 34184 vdb-entry
- MDVSA-2009:096 vendor-advisory
- 35559 third-party-advisory
- 34373 third-party-advisory
- 34398 third-party-advisory
- USN-757-1 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=261087
- RHSA-2009:0345 vendor-advisory
- FEDORA-2009-2883 vendor-advisory
- ADV-2009-0777 vdb-entry
- ghostscript-icclib-native-color-bo(49329) vdb-entry
- 20090319 rPSA-2009-0050-1 ghostscript mailing-list
- USN-743-1 vendor-advisory