Every CVE Search/ Get API key

CVE-2009-0584

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in...

9.3 HighFix available

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Exploit likelihood

4.07%Up 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0584
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0584
Updated
2026-11-02
EUVDEUVD-2009-0587 No score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
EUVD-2009-0587
Updated
2026-11-03
GitHub AdvisoriesGHSA-3cwm-mjh6-3hwq No score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in...

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
GHSA-3cwm-mjh6-3hwq
Updated
2026-11-02
OSV No score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
CVE-2009-0584
Updated
2026-11-02
OSVDEBIAN-CVE-2009-0584 No score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Record
DEBIAN-CVE-2009-0584
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
argyll
Debian:12
 before 1.0.3-2
1.0.3-2
argyll
Debian:13
 before 1.0.3-2
1.0.3-2
argyll
Debian:14
 before 1.0.3-2
1.0.3-2
ghostscript
Debian:12
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:13
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:14
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
gs-gpl
Debian:4.0
 before 8.54.dfsg.1-5etch2, plus listed versions
8.54.dfsg.1-58.54.dfsg.1-5etch1
8.54.dfsg.1-5etch2
ghostscript
Debian:5.0
 before 8.62.dfsg.1-3.2lenny1, plus listed versions
8.62.dfsg.1-3.2lenny0
8.62.dfsg.1-3.2lenny1
ghostscript
Debian:6.0
 before 8.64~dfsg-1+squeeze1
8.64~dfsg-1+squeeze1
ghostscript
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
Show 41 moreShow less
Affected packages
PackageAffectedFixed
ghostscript-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::as
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::desktop
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::es
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
ghostscript-devel
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.17
0:7.05-32.1.17
hpijs
Red Hat:enterprise_linux:3::ws
 before 0:1.3-32.1.17
0:1.3-32.1.17
ghostscript
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-devel
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript-gtk
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.5
0:7.07-33.2.el4_7.5
ghostscript
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-gtk
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-devel
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4
ghostscript-gtk
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.4
0:8.15.2-9.4.el5_3.4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0584 is a high vulnerability (CVSS 9.3) in Argyllcms Cms, published March 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.07%, the 90th percentile. Fixed in argyll 1.0.3-2.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open