CVE-2012-4405

EUVD-2012-4343

18.09.2012, 17:55

Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow.  NOTE: this issue is also described as an array index error.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.8 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 96%

Affected Products (NVD)

Vendor	Product	Version
argyllcms	cms	-
color	icclib	-
ghostscript	ghostscript	9.06

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

argyll

bookworm	2.3.1+repack-1.1 fixed
bullseye	2.0.1+repack-1.1 fixed
sid	3.1.0+repack-1.1 fixed
squeeze	no-dsa
trixie	3.1.0+repack-1.1 fixed

ghostscript

bookworm	10.0.0~dfsg-11+deb12u4 fixed
bookworm (security)	10.0.0~dfsg-11+deb12u5 fixed
bullseye	9.53.3~dfsg-7+deb11u7 fixed
bullseye (security)	9.53.3~dfsg-7+deb11u8 fixed
sid	10.04.0~dfsg-1 fixed
squeeze	no-dsa
trixie	10.04.0~dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

argyll

hardy	dne
lucid	ignored
natty	ignored
oneiric	ignored
precise	ignored
quantal	not-affected
raring	not-affected
saucy	not-affected
trusty	dne
utopic	not-affected
vivid	not-affected
wily	not-affected
xenial	not-affected
yakkety	not-affected
zesty	not-affected

ghostscript

hardy	Fixed 8.61.dfsg.1-1ubuntu3.5 released
lucid	Fixed 8.71.dfsg.1-0ubuntu5.5 released
natty	not-affected
oneiric	not-affected
precise	not-affected
quantal	not-affected
raring	not-affected
saucy	not-affected
trusty	dne
utopic	not-affected
vivid	not-affected
wily	not-affected
xenial	not-affected
yakkety	not-affected
zesty	not-affected