CVE-2012-4405

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-4405
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00031.html
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00001.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00015.html
http://rhn.redhat.com/errata/RHSA-2012-1256.html
http://secunia.com/advisories/50719
http://security.gentoo.org/glsa/glsa-201412-17.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2012:151
http://www.mandriva.com/security/advisories?name=MDVSA-2013:089
http://www.mandriva.com/security/advisories?name=MDVSA-2013:090
http://www.openwall.com/lists/oss-security/2012/09/11/2
http://www.securityfocus.com/bid/55494
http://www.securitytracker.com/id?1027517
http://www.ubuntu.com/usn/USN-1581-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/78411
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0301
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:argyllcms:cms:-:*:*:*:*:*:*:*
cpe:2.3:a:color:icclib:-:*:*:*:*:*:*:*
cpe:2.3:a:ghostscript:ghostscript:9.06:*:*:*:*:*:*:*
History

07 Nov 2023, 02:11

Type Values Removed Values Added
Summary Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error. Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.

13 Feb 2023, 04:34

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=854227', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=854227', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2012:1256', 'name': 'https://access.redhat.com/errata/RHSA-2012:1256', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2012-4405', 'name': 'https://access.redhat.com/security/cve/CVE-2012-4405', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2012-4405 ghostscript, argyllcms: Array index error leading to heap-based bufer OOB write Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.

02 Feb 2023, 18:16

Type Values Removed Values Added
Summary Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error. CVE-2012-4405 ghostscript, argyllcms: Array index error leading to heap-based bufer OOB write
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=854227 -
  • (MISC) https://access.redhat.com/errata/RHSA-2012:1256 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2012-4405 -
Information

Published : 2012-09-18 17:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-4405

Mitre link : CVE-2012-4405

CVE.ORG link : CVE-2012-4405

JSON object : View

Products Affected

argyllcms

  • cms

ghostscript

  • ghostscript

color

  • icclib
CWE
CWE-189

Numeric Errors