Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1) DocumentMedia, (2) DocumentPaperSizes, and possibly (3) PageMedia and (4) PaperSize headers. NOTE: this issue can be exploited through other products that use gv such as evince.

A stackoverflow in the postscript viewer gv could be used to exploited to execute code, if the user could be tricked into viewing a prepared postscript file. (CVE-2006-5864)

Specially crafted Postscript files could be used to execute arbitrary code by causing a buffer overflow in evince. (CVE-2006-5864)

USN-390-2 fixed vulnerabilities in evince. This update provides the corresponding update for evince-gtk.

A buffer overflow was discovered in the PostScript processor included in evince. By tricking a user into opening a specially crafted PS file, an attacker could crash evince or execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-390-1 fixed a vulnerability in evince. The original fix did not fully solve the problem, allowing for a denial of service in certain situations.

A buffer overflow was discovered in the PostScript processor included in evince. By tricking a user into opening a specially crafted PS file, an attacker could crash evince or execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in the PostScript processor included in evince. By tricking a user into opening a specially crafted PS file, an attacker could crash evince or execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted Postscript files could be used to execute arbitrary code by causing a buffer overflow in evince (CVE-2006-5864).

The remote host is affected by the vulnerability described in GLSA-200704-06 (Evince: Stack overflow in included gv code)

    Evince includes code from GNU gv that does not properly boundary check     user-supplied data before copying it into process buffers.
  Impact :

    An attacker could entice a user to open a specially crafted PostScript     document with Evince and possibly execute arbitrary code with the     rights of the user running Evince.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200703-24 (mgv: Stack overflow in included gv code)

    mgv includes code from gv that does not properly boundary check     user-supplied data before copying it into process buffers.
  Impact :

    An attacker could entice a user to open a specially crafted Postscript     document with mgv and possibly execute arbitrary code with the rights     of the user running mgv.
  Workaround :

    There is no known workaround at this time.

Stack-based buffer overflow in ps.c for evince allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.

Packages have been patched to correct this issue.

Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.

Packages have been patched to correct this issue.

Update :

The patch used in the previous update still left the possibility of causing X to consume unusual amounts of memory if gv is used to view a carefully crafted image designed to exploit CVE-2006-5864. This update uses an improved patch to address this issue.

Renaud Lifchitz discovered that gv, the PostScript and PDF viewer for X, performs insufficient boundary checks in the Postscript parsing code, which allows the execution of arbitrary code through a buffer overflow. Evince embeds a copy of gv and needs an update as well.

Secunia reports :

A vulnerability has been discovered in Evince, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the 'get_next_text()' function in ps/ps.c. This can be exploited to cause a buffer overflow by e.g. tricking a user into opening a specially crafted PostScript file.

The remote host is affected by the vulnerability described in GLSA-200611-20 (GNU gv: Stack overflow)

    GNU gv does not properly boundary check user-supplied data before     copying it into process buffers.
  Impact :

    An attacker could entice a user to open a specially crafted document     with GNU gv and execute arbitrary code with the rights of the user on     the system.
  Workaround :

    There is no known workaround at this time.

The original update provided in DSA 1214-1 was insufficient; this update corrects this. For reference please find the original advisory text below :

  Renaud Lifchitz discovered that gv, the PostScript and PDF viewer   for X, performs insufficient boundary checks in the Postscript   parsing code, which allows the execution of arbitrary code through a   buffer overflow.

ID	Name	Product	Family	Severity
29454	SuSE 10 Security Update : gv (ZYPP Patch Number 2267)	Nessus	SuSE Local Security Checks	medium
29422	SuSE 10 Security Update : evince (ZYPP Patch Number 2358)	Nessus	SuSE Local Security Checks	medium
27975	Ubuntu 6.06 LTS / 6.10 : evince-gtk vulnerability (USN-390-3)	Nessus	Ubuntu Local Security Checks	medium
27974	Ubuntu 5.10 / 6.06 LTS / 6.10 : evince vulnerability (USN-390-2)	Nessus	Ubuntu Local Security Checks	medium
27973	Ubuntu 5.10 / 6.06 LTS / 6.10 : evince vulnerability (USN-390-1)	Nessus	Ubuntu Local Security Checks	medium
27255	openSUSE 10 Security Update : gv (gv-2266)	Nessus	SuSE Local Security Checks	medium
27209	openSUSE 10 Security Update : evince (evince-2362)	Nessus	SuSE Local Security Checks	medium
25019	GLSA-200704-06 : Evince: Stack overflow in included gv code	Nessus	Gentoo Local Security Checks	medium
24929	GLSA-200703-24 : mgv: Stack overflow in included gv code	Nessus	Gentoo Local Security Checks	medium
24612	Mandrake Linux Security Advisory : evince (MDKSA-2006:229)	Nessus	Mandriva Local Security Checks	medium
24599	Mandrake Linux Security Advisory : gv (MDKSA-2006:214-1)	Nessus	Mandriva Local Security Checks	medium
23948	Debian DSA-1243-1 : evince - buffer overflow	Nessus	Debian Local Security Checks	medium
23872	FreeBSD : evince -- Buffer Overflow Vulnerability (779a2d55-8ba8-11db-81d5-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
23728	GLSA-200611-20 : GNU gv: Stack overflow	Nessus	Gentoo Local Security Checks	medium
23700	Debian DSA-1214-2 : gv - buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2006-5864

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium