Description
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | argyll | 1.0.3-3 | — |
| Debian 14 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 13 | argyll | 1.0.3-3 | — |
| Debian 13 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 12 | argyll | 1.0.3-3 | — |
| Debian 12 | ghostscript | 8.64~dfsg-1.1 | — |
| Debian 6.0 | ghostscript | 8.64~dfsg-1+squeeze1 | DTSA-198-1 |
| Debian 5.0 | ghostscript | 8.62.dfsg.1-3.2lenny4 | DSA-2080-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ghostscript +2 | 8.15.2-9.4.el5_3.7 | RHSA-2009:0421 |
| RHEL 4 | ghostscript +2 | 7.07-33.2.el4_7.8 | RHSA-2009:0420 |
| RHEL 3 | ghostscript +1 | 7.05-32.1.20 | RHSA-2009:0420 |
| RHEL 3 | hpijs | 1.3-32.1.20 | RHSA-2009:0420 |
Advisories 4
- RHSA-2009:0421 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0420 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2080-1 ghostscript - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-198-1 ghostscript - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:11207 vdb-entry signature
- RHSA-2009:0421 vendor-advisory
- FEDORA-2009-3709 vendor-advisory
- GLSA-201412-17 vendor-advisory
- RHSA-2009:0420 vendor-advisory
- FEDORA-2009-3430 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=491853
- 262288 vendor-advisory
- ghostscript-icc-bo(50381) vdb-entry
- 20090417 rPSA-2009-0060-1 ghostscript mailing-list
- 34729 third-party-advisory
- FEDORA-2009-3435 vendor-advisory
- SUSE-SR:2009:011 vendor-advisory
- MDVSA-2009:095 vendor-advisory
- FEDORA-2009-3710 vendor-advisory
- 34711 third-party-advisory
- 34732 third-party-advisory
- 35569 third-party-advisory
- ADV-2009-1708 vdb-entry
- MDVSA-2009:096 vendor-advisory
- 35559 third-party-advisory
- 34373 third-party-advisory
- 35416 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0060
- USN-757-1 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-155.htm
- 34726 third-party-advisory
- SUSE-SR:2009:009 vendor-advisory
- 34667 third-party-advisory