Every CVE Search/ Get API key

CVE-2009-0583

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library ...

9.3 HighFix available

CVE-2009-0583 is a high vulnerability (CVSS 9.3) in Ghostscript, published March 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.75%, the 91st percentile. Fixed in argyll 1.0.3-2.

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Exploit likelihood

4.75%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0583
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0583
Updated
2026-11-02
EUVDEUVD-2009-0586 No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
EUVD-2009-0586
Updated
2026-11-03
GitHub AdvisoriesGHSA-hc6x-m9mp-6xc2 No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library ...

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
GHSA-hc6x-m9mp-6xc2
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0583
Updated
2026-11-02
OSVDEBIAN-CVE-2009-0583 No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
DEBIAN-CVE-2009-0583
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
argyll
Debian:12
 before 1.0.3-2
1.0.3-2
argyll
Debian:13
 before 1.0.3-2
1.0.3-2
argyll
Debian:14
 before 1.0.3-2
1.0.3-2
ghostscript
Debian:12
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:13
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:14
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
gs-gpl
Debian:4.0
 before 8.54.dfsg.1-5etch2, plus listed versions
8.54.dfsg.1-58.54.dfsg.1-5etch1
8.54.dfsg.1-5etch2
ghostscript
Debian:5.0
 before 8.62.dfsg.1-3.2lenny1, plus listed versions
8.62.dfsg.1-3.2lenny0
8.62.dfsg.1-3.2lenny1
ghostscript
Debian:6.0
 before 8.64~dfsg-1+squeeze1
8.64~dfsg-1+squeeze1
ghostscript
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
Show 41 moreShow less
Affected packages
PackageAffectedFixed
ghostscript-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::as
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::desktop
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::es
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::ws
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-gtk
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-devel
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-gtk
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open