CVE-2010-1628
published 2010-05-19CVE-2010-1628: Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited…
PriorityP344critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.04%
89.6th percentile
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | >= 0 < 8.71~dfsg2-4 | 8.71~dfsg2-4 |
| artifex | ghostscript | >= 0 < 8.71~dfsg2-4 | 8.71~dfsg2-4 |
| artifex | ghostscript | >= 0 < 8.71~dfsg2-4 | 8.71~dfsg2-4 |
| artifex | ghostscript | >= 0 < 8.71~dfsg2-4 | 8.71~dfsg2-4 |
| artifex | gpl_ghostscript | — | — |
| artifex | gpl_ghostscript | — | — |
| debian | ghostscript | < ghostscript 8.71~dfsg2-4 (bookworm) | ghostscript 8.71~dfsg2-4 (bookworm) |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3MEDIUM
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-67rg-j83g-ppg2: Ghostscript 8
ghsa_unreviewed·2022-05-14
CVE-2010-1628 [HIGH] CWE-119 GHSA-67rg-j83g-ppg2: Ghostscript 8
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
OSV
CVE-2010-1628: Ghostscript 8
osv·2010-05-19·CVSS 9.3
CVE-2010-1628 [CRITICAL] CVE-2010-1628: Ghostscript 8
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2010-07-13·CVSS 9.3
CVE-2010-1628 [CRITICAL] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
David Srbecky discovered that Ghostscript incorrectly handled debug
logging. If a user or automated system were tricked into opening a crafted
PDF file, an attacker could cause a denial of service or execute arbitrary
code with privileges of the user invoking the program. This issue only
affected Ubuntu 9.04 and Ubuntu 9.10. The default compiler options for
affected releases should reduce the vulnerability to a denial of service.
(CVE-2009-4270)
It was discovered that Ghostscript incorrectly handled certain malformed
files. If a user or automated system were tricked into opening a crafted
Postscript or PDF file, an attacker could cause a denial of service or
execute arbitrary code with privileges of the user invoking the program.
This issue only affecte
Red Hat
ghostscript: internal stack overflow due to recursive calls
vendor_redhat·2010-05-11·CVSS 9.3
CVE-2010-1628 [CRITICAL] ghostscript: internal stack overflow due to recursive calls
ghostscript: internal stack overflow due to recursive calls
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
Statement: Not vulnerable. This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Package: ghostscript (Red Hat Enterprise Linux 4) - Not affected
Package: ghostscript (Red Hat Enterprise Linux 5) - Not affected
Package: ghostscript (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2010-1628: ghostscript - Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent att...
vendor_debian·2010·CVSS 9.3
CVE-2010-1628 [CRITICAL] CVE-2010-1628: ghostscript - Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent att...
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
Scope: local
bookworm: resolved (fixed in 8.71~dfsg2-4)
bullseye: resolved (fixed in 8.71~dfsg2-4)
forky: resolved (fixed in 8.71~dfsg2-4)
sid: resolved (fixed in 8.71~dfsg2-4)
trixie: resolved (fixed in 8.71~dfsg2-4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls [fedora-all]
bugzilla·2010-07-15·CVSS 9.3
CVE-2010-1628 [CRITICAL] CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls [fedora-all]
CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=592492
Please note: this issue affe
Bugzilla
CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls
bugzilla·2010-05-14·CVSS 9.3
CVE-2010-1628 [CRITICAL] CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls
CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls
The following vulnerability was reported to Ubuntu's bug tracker [1] by Dan Rosenberg:
1. The Ghostscript interpreter fails to properly handle some cases of infinite recursion. By creating a .ps file with a sequence such as:
/A{pop 0 A 0} bind def
/product A 0
The interpreter's internal stack will be overflowed with recursive calls. Rather than gracefully handling this situation, the interpreter continues execution by jumping to an (usually invalid) address near (or past) the tail end of the stack. Without further manipulation, this would simply result in a segfault, but it turns out that by altering the number of variable definitions that occur before the call to the infinitely recursive procedure, the user can
http://bugs.ghostscript.com/show_bug.cgi?id=691295http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://seclists.org/fulldisclosure/2010/May/134http://secunia.com/advisories/39753http://secunia.com/advisories/40580http://security.gentoo.org/glsa/glsa-201412-17.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:134http://www.openwall.com/lists/oss-security/2010/05/12/1http://www.openwall.com/lists/oss-security/2010/05/18/7http://www.securityfocus.com/archive/1/511243/100/0/threadedhttp://www.securityfocus.com/bid/40107http://www.ubuntu.com/usn/USN-961-1http://www.vupen.com/english/advisories/2010/1138https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/546009http://bugs.ghostscript.com/show_bug.cgi?id=691295http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://seclists.org/fulldisclosure/2010/May/134http://secunia.com/advisories/39753http://secunia.com/advisories/40580http://security.gentoo.org/glsa/glsa-201412-17.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:134http://www.openwall.com/lists/oss-security/2010/05/12/1http://www.openwall.com/lists/oss-security/2010/05/18/7http://www.securityfocus.com/archive/1/511243/100/0/threadedhttp://www.securityfocus.com/bid/40107http://www.ubuntu.com/usn/USN-961-1http://www.vupen.com/english/advisories/2010/1138https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/546009
2010-05-19
Published