Every CVE Search/ Get API key

CVE-2009-0792

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library ...

9.3 HighFix available

CVE-2009-0792 is a high vulnerability (CVSS 9.3) in Ghostscript, published April 4, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.99%, the 90th percentile. Fixed in argyll 1.0.3-3.

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Exploit likelihood

3.99%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
CVE-2009-0792
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
CVE-2009-0792
Updated
2026-11-02
EUVDEUVD-2009-0790 No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
EUVD-2009-0790
Updated
2026-11-03
GitHub AdvisoriesGHSA-c674-58j3-3v3w No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library ...

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
GHSA-c674-58j3-3v3w
Updated
2026-11-02
OSVBELL-CVE-2009-0792 9.3

CVE-2009-0792 does not affect BellSoft software

Record
BELL-CVE-2009-0792
CVSS 2.0
9.3 CriticalAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
OSV No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
CVE-2009-0792
Updated
2026-11-02
OSVDEBIAN-CVE-2009-0792 No score

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

Record
DEBIAN-CVE-2009-0792
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
argyll
Debian:12
 before 1.0.3-3
1.0.3-3
argyll
Debian:13
 before 1.0.3-3
1.0.3-3
argyll
Debian:14
 before 1.0.3-3
1.0.3-3
ghostscript
Debian:12
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:13
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:14
 before 8.64~dfsg-1.1
8.64~dfsg-1.1
ghostscript
Debian:5.0
 before 8.62.dfsg.1-3.2lenny4, plus listed versions
8.62.dfsg.1-3.2lenny08.62.dfsg.1-3.2lenny18.62.dfsg.1-3.2lenny2
8.62.dfsg.1-3.2lenny4
ghostscript
Debian:6.0
 before 8.64~dfsg-1+squeeze1
8.64~dfsg-1+squeeze1
ghostscript
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.20
0:7.05-32.1.20
Show 40 moreShow less
Affected packages
PackageAffectedFixed
ghostscript-devel
Red Hat:enterprise_linux:3::as
 before 0:7.05-32.1.20
0:7.05-32.1.20
hpijs
Red Hat:enterprise_linux:3::as
 before 0:1.3-32.1.20
0:1.3-32.1.20
ghostscript
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-devel
Red Hat:enterprise_linux:3::desktop
 before 0:7.05-32.1.20
0:7.05-32.1.20
hpijs
Red Hat:enterprise_linux:3::desktop
 before 0:1.3-32.1.20
0:1.3-32.1.20
ghostscript
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-devel
Red Hat:enterprise_linux:3::es
 before 0:7.05-32.1.20
0:7.05-32.1.20
hpijs
Red Hat:enterprise_linux:3::es
 before 0:1.3-32.1.20
0:1.3-32.1.20
ghostscript
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.20
0:7.05-32.1.20
ghostscript-devel
Red Hat:enterprise_linux:3::ws
 before 0:7.05-32.1.20
0:7.05-32.1.20
hpijs
Red Hat:enterprise_linux:3::ws
 before 0:1.3-32.1.20
0:1.3-32.1.20
ghostscript
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-devel
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-gtk
Red Hat:enterprise_linux:4::as
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-devel
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-gtk
Red Hat:enterprise_linux:4::desktop
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-devel
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-gtk
Red Hat:enterprise_linux:4::es
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-devel
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript-gtk
Red Hat:enterprise_linux:4::ws
 before 0:7.07-33.2.el4_7.8
0:7.07-33.2.el4_7.8
ghostscript
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-gtk
Red Hat:enterprise_linux:5::client
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-devel
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7
ghostscript-gtk
Red Hat:enterprise_linux:5::server
 before 0:8.15.2-9.4.el5_3.7
0:8.15.2-9.4.el5_3.7

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open