Strix
26.1K

CVE-2012-4405

UnknownEPSS 7.49%

Last modified

CVE-2012-4405 is a vulnerability of currently unknown severity. Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.. EPSS estimates a 7.49% chance of exploitation in the next 30 days.

Description

Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.

Metrics

EPSS Probability
7.49%

93.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ArgyllcmsCmsAll versions
ColorIcclibAll versions
GhostscriptGhostscript9.06

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-4405?
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.
How severe is CVE-2012-4405?
Severity scoring for CVE-2012-4405 is pending analysis. The EPSS model estimates a 7.49% probability of exploitation in the next 30 days.
How do I fix CVE-2012-4405?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2012

View all 2012CVEs →

Are you affected by CVE-2012-4405?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST