Vulnerability Name:

CVE-2010-1628 (CCN-58547)

Assigned:2010-05-11
Published:2010-05-11
Updated:2018-10-10
Summary:Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.5 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Tue May 11 2010
Multiple memory corruption vulnerabilities in Ghostscript

Source: MISC
Type: UNKNOWN
http://bugs.ghostscript.com/show_bug.cgi?id=691295

Source: MITRE
Type: CNA
CVE-2010-1628

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:014

Source: FULLDISC
Type: Exploit
20100511 Multiple memory corruption vulnerabilities in Ghostscript

Source: CCN
Type: SA39753
GhostScript PostScript File Processing Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
39753

Source: SECUNIA
Type: Vendor Advisory
40580

Source: GENTOO
Type: UNKNOWN
GLSA-201412-17

Source: DEBIAN
Type: DSA-2093
ghostscript -- several vulnerabilities

Source: CCN
Type: Ghostscript Web site
Ghostscript

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2010:134

Source: MLIST
Type: Exploit
[oss-security] 20100511 Re: CVE assignment: ghostscript stack-based overflow

Source: MLIST
Type: Exploit
[oss-security] 20100518 Re: CVE assignment: ghostscript stack-based overflow

Source: CCN
Type: OSVDB ID: 64542
GhostScript PostScript File Processing Interpreter Stack Memory Corruption

Source: BUGTRAQ
Type: UNKNOWN
20100512 Multiple memory corruption vulnerabilities in Ghostscript

Source: BID
Type: Exploit
40107

Source: CCN
Type: BID-40107
Ghostscript PostScript Infinite Recursion Remote Memory Corruption Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-961-1

Source: VUPEN
Type: Vendor Advisory
ADV-2010-1138

Source: MISC
Type: Exploit
https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/546009

Source: XF
Type: UNKNOWN
ghostscript-postscript-code-execution(58547)

Source: SUSE
Type: SUSE-SR:2010:015
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:artifex:gpl_ghostscript:8.64:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.70:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ghostscript:ghostscript:8.64:*:*:*:*:*:*:*
  • OR cpe:/a:ghostscript:ghostscript:8.70:*:*:*:*:*:*:*
  • AND
  • cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20101628
    V
    		CVE-2010-1628
    2022-05-20
    oval:org.mitre.oval:def:12750
    P
    		USN-961-1 -- ghostscript vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:12743
    P
    		DSA-2093-1 ghostscript -- several
    2014-06-23
    oval:org.debian:def:2093
    V
    		several vulnerabilities
    2010-08-19
    BACK
    artifex gpl ghostscript 8.64
    artifex gpl ghostscript 8.70
    ghostscript ghostscript 8.64
    ghostscript ghostscript 8.70
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.0
    mandriva linux 2009.0
    mandriva linux 2009.0 -
    debian debian linux 5.0
    mandriva linux 2009.1
    mandriva linux 2009.1
    mandriva enterprise server 5
    mandriva enterprise server 5
    mandriva linux 2010
    mandriva linux 2010