CVE-2009-0584

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in...

9.3 HighFix available

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

Exploit likelihood

4.07%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used9.3

Record: CVE-2009-0584
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-189
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2009-0584
Updated: 2026-11-02

EUVDEUVD-2009-0587No score

Record: EUVD-2009-0587
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3cwm-mjh6-3hwqNo score

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in...

Record: GHSA-3cwm-mjh6-3hwq
Updated: 2026-11-02

OSVNo score

Record: CVE-2009-0584
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-0584No score

Record: DEBIAN-CVE-2009-0584
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`argyll` Debian:12	before 1.0.3-2	1.0.3-2
`argyll` Debian:13	before 1.0.3-2	1.0.3-2
`argyll` Debian:14	before 1.0.3-2	1.0.3-2
`ghostscript` Debian:12	before 8.64~dfsg-1.1	8.64~dfsg-1.1
`ghostscript` Debian:13	before 8.64~dfsg-1.1	8.64~dfsg-1.1
`ghostscript` Debian:14	before 8.64~dfsg-1.1	8.64~dfsg-1.1
`gs-gpl` Debian:4.0 From an advisory covering 2 CVEs	before 8.54.dfsg.1-5etch2, plus listed versions 8.54.dfsg.1-58.54.dfsg.1-5etch1	8.54.dfsg.1-5etch2
`ghostscript` Debian:5.0 From an advisory covering 2 CVEs	before 8.62.dfsg.1-3.2lenny1, plus listed versions 8.62.dfsg.1-3.2lenny0	8.62.dfsg.1-3.2lenny1
`ghostscript` Debian:6.0 From an advisory covering 4 CVEs	before 8.64~dfsg-1+squeeze1	8.64~dfsg-1+squeeze1
`ghostscript` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17

Show 41 moreShow less

Affected packages
Package	Affected	Fixed
`ghostscript-debuginfo` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-devel` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`hpijs` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:1.3-32.1.17	0:1.3-32.1.17
`ghostscript` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-debuginfo` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-devel` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`hpijs` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:1.3-32.1.17	0:1.3-32.1.17
`ghostscript` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-debuginfo` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-devel` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`hpijs` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:1.3-32.1.17	0:1.3-32.1.17
`ghostscript` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-debuginfo` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`ghostscript-devel` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:7.05-32.1.17	0:7.05-32.1.17
`hpijs` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:1.3-32.1.17	0:1.3-32.1.17
`ghostscript` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-debuginfo` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-devel` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-gtk` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-debuginfo` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-devel` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-gtk` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-debuginfo` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-devel` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-gtk` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-debuginfo` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-devel` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript-gtk` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:7.07-33.2.el4_7.5	0:7.07-33.2.el4_7.5
`ghostscript` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-devel` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-gtk` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-devel` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4
`ghostscript-gtk` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:8.15.2-9.4.el5_3.4	0:8.15.2-9.4.el5_3.4

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0584 is a high vulnerability (CVSS 9.3) in Argyllcms Cms, published March 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.07%, the 90th percentile. Fixed in argyll 1.0.3-2.

References

Show 47 moreShow less