CVE-2009-4270

CRITICAL 9.3CVE-2009-4270 · Published 21/12/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
ghostscript ghostscript	`= 8.64= 8.70`	No fix yet

Description

Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file, as originally reported for debug logging code in gdevcups.c in the CUPS output driver.

References

bugs.ghostscript.com/show_bug.cgi
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
osvdb.org/61140
secunia.com/advisories/37851 · Vendor Advisory
secunia.com/advisories/40580
security.gentoo.org/glsa/glsa-201412-17.xml
mandriva.com/security/advisories
mandriva.com/security/advisories
openwall.com/lists/oss-security/2009/12/18/1
openwall.com/lists/oss-security/2009/12/18/2
securityfocus.com/bid/37410 · Exploit
ubuntu.com/usn/USN-961-1
vupen.com/english/advisories/2009/3597 · Vendor Advisory
bugzilla.redhat.com/show_bug.cgi

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free