CVE-2009-0583

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

• CWE-119

• http://bugs.gentoo.org/show_bug.cgi?id=261087
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
• http://secunia.com/advisories/34266Vendor Advisory
• http://secunia.com/advisories/34373Vendor Advisory
• http://secunia.com/advisories/34381Vendor Advisory
• http://secunia.com/advisories/34393Vendor Advisory
• http://secunia.com/advisories/34398Vendor Advisory
• http://secunia.com/advisories/34418Vendor Advisory
• http://secunia.com/advisories/34437Vendor Advisory
• http://secunia.com/advisories/34443Vendor Advisory
• http://secunia.com/advisories/34469Vendor Advisory
• http://secunia.com/advisories/34729
• http://secunia.com/advisories/35559
• http://secunia.com/advisories/35569
• http://securitytracker.com/id?1021868
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm
• http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050Vendor Advisory
• http://www.auscert.org.au/render.html?it=10666US Government Resource
• http://www.debian.org/security/2009/dsa-1746Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200903-37.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:095
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:096
• http://www.redhat.com/support/errata/RHSA-2009-0345.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/501994/100/0/threaded
• http://www.securityfocus.com/bid/34184
• http://www.ubuntu.com/usn/USN-743-1
• http://www.vupen.com/english/advisories/2009/0776Vendor Advisory
• http://www.vupen.com/english/advisories/2009/0777Vendor Advisory
• http://www.vupen.com/english/advisories/2009/0816Vendor Advisory
• http://www.vupen.com/english/advisories/2009/1708
• https://bugzilla.redhat.com/show_bug.cgi?id=487742Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49329
• https://issues.rpath.com/browse/RPL-2991
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10795
• https://usn.ubuntu.com/757-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00770.htmlVendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00772.htmlVendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00887.html
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00916.html
• http://bugs.gentoo.org/show_bug.cgi?id=261087
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
• http://secunia.com/advisories/34266Vendor Advisory
• http://secunia.com/advisories/34373Vendor Advisory
• http://secunia.com/advisories/34381Vendor Advisory
• http://secunia.com/advisories/34393Vendor Advisory
• http://secunia.com/advisories/34398Vendor Advisory
• http://secunia.com/advisories/34418Vendor Advisory
• http://secunia.com/advisories/34437Vendor Advisory
• http://secunia.com/advisories/34443Vendor Advisory
• http://secunia.com/advisories/34469Vendor Advisory
• http://secunia.com/advisories/34729
• http://secunia.com/advisories/35559
• http://secunia.com/advisories/35569
• http://securitytracker.com/id?1021868
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm
• http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050Vendor Advisory
• http://www.auscert.org.au/render.html?it=10666US Government Resource
• http://www.debian.org/security/2009/dsa-1746Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200903-37.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:095
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:096
• http://www.redhat.com/support/errata/RHSA-2009-0345.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/501994/100/0/threaded
• http://www.securityfocus.com/bid/34184
• http://www.ubuntu.com/usn/USN-743-1
• http://www.vupen.com/english/advisories/2009/0776Vendor Advisory
• http://www.vupen.com/english/advisories/2009/0777Vendor Advisory
• http://www.vupen.com/english/advisories/2009/0816Vendor Advisory
• http://www.vupen.com/english/advisories/2009/1708
• https://bugzilla.redhat.com/show_bug.cgi?id=487742Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49329
• https://issues.rpath.com/browse/RPL-2991
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10795
• https://usn.ubuntu.com/757-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00770.htmlVendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00772.htmlVendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00887.html
• https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00916.html

Published

Mar 23, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0577Integer overflow in the WriteProlog function in texttops in …
• CVE-2009-0578GNOME NetworkManager before 0.7.0.99 does not properly verif…
• CVE-2009-0579Linux-PAM before 1.0.4 does not enforce the minimum password…
• CVE-2009-0580Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, an…
• CVE-2009-0581Memory leak in LittleCMS (aka lcms or liblcms) before 1.18be…
• CVE-2009-0582The ntlm_challenge function in the NTLM SASL authentication …
• CVE-2009-0584icc.c in the International Color Consortium (ICC) Format lib…
• CVE-2009-0585Integer overflow in the soup_base64_encode function in soup-…
• CVE-2009-0586Integer overflow in the gst_vorbis_tag_add_coverart function…
• CVE-2009-0587Multiple integer overflows in Evolution Data Server (aka evo…
• CVE-2009-0588agent/request/op.cgi in the Registration Authority (RA) comp…
• CVE-2009-0589Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…