kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Entry for ghostscrip-gpl 8.61

Browse source 
Reviewed by:	ports-security@ (simon, remko)
This commit is contained in:
Rong-En Fan 2008-03-05 07:13:14 +00:00
parent c7cd20ce97
commit 9dc96cd5b1
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=208459
1 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
security/vuxml/vuln.xml
View file

@ -34,6 +34,39 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="ca8e56d5-e856-11dc-b5af-0017319806e7">
<topic>ghostscript -- zseticcspace() function buffer overflow vulnerability</topic>
<affects>
<package>
<name>ghostscript-gpl</name>
<name>ghostscript-gpl-nox11</name>
<range><lt>8.61_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans from the Google Security Team reports:</p>
<blockquote cite="http://scary.beasts.org/security/CESA-2008-001.html">
<p>Severity: parsing of evil PostScript file will result in
arbitrary code execution.</p>
<p>A stack-based buffer overflow in the zseticcspace() function
in zicc.c allows remote arbitrary code execution via a
malicious PostScript file (.ps) that contains a long Range
array.</p>
</blockquote>
</body>
</description>
<references>
<bid>28017</bid>
<cvename>CVE-2008-0411</cvename>
<url>http://scary.beasts.org/security/CESA-2008-001.html</url>
</references>
<dates>
<discovery>2008-02-28</discovery>
<entry>2008-03-05</entry>
</dates>
</vuln>
<vuln vid="ce2f2ade-e7df-11dc-a701-000bcdc1757a">
<topic>phpmyadmin -- SQL injection vulnerability</topic>
<affects>