Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.

The remote NewStart CGSL host, running version MAIN 6.06, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter     by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute     arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3781)

  - The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before     1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the     heap via malformed image files, as originally demonstrated using imagemagick convert. (CVE-2007-2721)

  - Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows     remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a     .seticcspace operator. (CVE-2008-0411)

  - Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2     decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to     execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length     value. (CVE-2009-0196)

  - Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka     icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and     earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and     application crash) or possibly execute arbitrary code by using a device file for a translation request     that operates on a crafted image file and targets a certain native color space, related to an ICC     profile in a (1) PostScript or (2) PDF file with embedded images. (CVE-2009-0583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201412-17 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF using GPL Ghostscript, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ghostscript fixes the following security issues :

  - Specially crafted postscript (.ps) files can cause     buffer overflows in ghostscript that could potentially     be exploited to execute arbitrary code. (CVE-2010-1869 /     CVE-2010-1628 / CVE-2009-4270)

  - By default, ghostscript reads certain initialization     files from the current working directory. Local     attackers could potentially exploit this to have other     users execute arbitrary commands by placing such files,     e.g. in /tmp. (CVE-2010-2055)

Two security issues have been discovered in Ghostscript, the GPL PostScript/PDF interpreter. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4897     A buffer overflow was discovered that allows remote     attackers to execute arbitrary code or cause a denial of     service via a crafted PDF document containing a long     name.

  - CVE-2010-1628     Dan Rosenberg discovered that ghostscript incorrectly     handled certain recursive Postscript files. An attacker     could execute arbitrary code via a PostScript file     containing unlimited recursive procedure invocations,     which trigger memory corruption in the stack of the     interpreter.

This update fixes memory corruption when a PostScript stack overflow occurs (CVE-2010-1628).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted postscript (.ps) files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code (CVE-2010-1628, CVE-2010-1869, CVE-2009-4270)

ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g.
in /tmp (CVE-2010-2055).

Multiple vulnerabilities has been found and corrected in ghostscript :

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name (CVE-2009-4897).

Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter (CVE-2010-1628).

As a precaution ghostscriptc has been rebuilt to link against the system libpng library which was fixed with MDVSA-2010:133

The updated packages have been patched to correct these issues.

Multiple vulnerabilities has been found and corrected in ghostscript :

Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file, as originally reported for debug logging code in gdevcups.c in the CUPS output driver (CVE-2009-4270).

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name (CVE-2009-4897).

Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter (CVE-2010-1628).

As a precaution ghostscript has been rebuilt to link against the system libpng library which was fixed with MDVSA-2010:133

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

David Srbecky discovered that Ghostscript incorrectly handled debug logging. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.04 and Ubuntu 9.10. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2009-4270)

It was discovered that Ghostscript incorrectly handled certain malformed files. If a user or automated system were tricked into opening a crafted Postscript or PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and Ubuntu 9.04. (CVE-2009-4897)

Dan Rosenberg discovered that Ghostscript incorrectly handled certain recursive Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2010-1628)

Rodrigo Rubira Branco and Dan Rosenberg discovered that Ghostscript incorrectly handled certain malformed Postscript files. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2010-1869).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
330512	NewStart CGSL MAIN 6.06 : ghostscript Multiple Vulnerabilities (NS-SA-2026-0055)	Nessus	NewStart CGSL Local Security Checks	Local	critical
79970	GLSA-201412-17 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
50909	SuSE 11 / 11.1 Security Update : ghostscript (SAT Patch Numbers 2708 / 2709)	Nessus	SuSE Local Security Checks	Local	high
48386	Debian DSA-2093-1 : ghostscript - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high
48358	Fedora 12 : ghostscript-8.71-7.fc12 (2010-11376)	Nessus	Fedora Local Security Checks	Local	high
48357	Fedora 13 : ghostscript-8.71-10.fc13 (2010-11325)	Nessus	Fedora Local Security Checks	Local	high
48236	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	Local	high
48233	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	Local	high
48194	Mandriva Linux Security Advisory : ghostscript (MDVSA-2010:136)	Nessus	Mandriva Local Security Checks	Local	high
48193	Mandriva Linux Security Advisory : ghostscript (MDVSA-2010:134)	Nessus	Mandriva Local Security Checks	Local	high
47815	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-1)	Nessus	SuSE Local Security Checks	Local	high
47734	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : ghostscript vulnerabilities (USN-961-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2010-1628

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high