USN-743-1: Ghostscript vulnerabilities
23 March 2009
Ghostscript vulnerabilities
Releases
Packages
- ghostscript -
- gs-gpl -
Details
It was discovered that Ghostscript contained multiple integer overflows in
its ICC color management library. If a user or automated system were
tricked into opening a crafted Postscript file, an attacker could cause a
denial of service or execute arbitrary code with privileges of the user
invoking the program. (CVE-2009-0583)
It was discovered that Ghostscript did not properly perform bounds checking
in its ICC color management library. If a user or automated system were
tricked into opening a crafted Postscript file, an attacker could cause a
denial of service or execute arbitrary code with privileges of the user
invoking the program. (CVE-2009-0584)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 8.10
Ubuntu 8.04
Ubuntu 7.10
Ubuntu 6.06
In general, a standard system upgrade is sufficient to effect the
necessary changes.
References
Related notices
- USN-757-1: gs-esp, gs-gpl, libgs8, ghostscript