Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61…
Priority MEDIUM 45CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
Why it matters now
EPSS 0.14523 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 62
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:* | 3.1 | Running on | Debian |
- cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:* Versions 3.1 Running on ·Debian
Show 52 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:* | 3.1 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:s-390:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:* | 2007 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007.0_x86_64:*:*:*:*:*:*:* | 2007.0_x86_64 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:* | 2007.1 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:* | 2007.1 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:* | 2008.0 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:* | 2008.0 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* | 3.0 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:* | 4.0 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrakesoft_corporate_server:3.0_x86_64:*:*:*:*:*:*:* | 3.0_x86_64 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrakesoft_corporate_server:4.0_x86_64:*:*:*:*:*:*:* | 4.0_x86_64 | Running on | Mandrakesoft |
| cpe:2.3:o:redhat:desktop:3.0:*:*:*:*:*:*:* | 3.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:desktop:4.0:*:*:*:*:*:*:* | 4.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:* | 5 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:as_3:*:*:*:*:*:*:* | as_3 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:as_4:*:*:*:*:*:*:* | as_4 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:es_3:*:*:*:*:*:*:* | es_3 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:es_4:*:*:*:*:*:*:* | es_4 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:ws_3:*:*:*:*:*:*:* | ws_3 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:ws_4:*:*:*:*:*:*:* | ws_4 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5:*:client:*:*:*:*:* | 5 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop_workstation:5:*:client:*:*:*:*:* | 5 | Running on | Red Hat |
| cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:* | 1 | Running on | Rpath |
| cpe:2.3:o:suse:novell_linux_pos:9:*:*:*:*:*:*:* | 9 | Running on | SUSE |
| cpe:2.3:o:suse:open_suse:10.2:*:*:*:*:*:*:* | 10.2 | Running on | SUSE |
| cpe:2.3:o:suse:open_suse:10.3:*:*:*:*:*:*:* | 10.3 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:9.0:*:enterprise_server:*:*:*:*:* | 9.0 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:10:sp1:enterprise_desktop:*:*:*:*:* | 10 sp1 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:10:sp1:enterprise_server:*:*:*:*:* | 10 sp1 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:10.1:*:ppc:*:*:*:*:* | 10.1 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:10.1:*:x86:*:*:*:*:* | 10.1 | Running on | SUSE |
| cpe:2.3:o:suse:suse_linux:10.1:*:x86_64:*:*:*:*:* | 10.1 | Running on | SUSE |
| cpe:2.3:o:suse:suse_open_enterprise_server:0:*:*:*:*:*:*:* | 0 | Running on | SUSE |
| cpe:2.3:a:ghostscript:ghostscript:*:*:*:*:*:*:*:* | up to 8.61 | Vulnerable | Ghostscript |
| cpe:2.3:a:ghostscript:ghostscript:0:*:*:*:*:*:*:* | 0 | Vulnerable | Ghostscript |
| cpe:2.3:a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:* | 8.0.1 | Vulnerable | Ghostscript |
| cpe:2.3:a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:* | 8.15 | Vulnerable | Ghostscript |
- cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:* Versions 3.1 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:s-390:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:* Versions 2007 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007.0_x86_64:*:*:*:*:*:*:* Versions 2007.0_x86_64 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrakesoft_corporate_server:3.0_x86_64:*:*:*:*:*:*:* Versions 3.0_x86_64 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrakesoft_corporate_server:4.0_x86_64:*:*:*:*:*:*:* Versions 4.0_x86_64 Running on ·Mandrakesoft
- cpe:2.3:o:redhat:desktop:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·Red Hat
- cpe:2.3:o:redhat:desktop:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:* Versions 5 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:as_3:*:*:*:*:*:*:* Versions as_3 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:as_4:*:*:*:*:*:*:* Versions as_4 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:es_3:*:*:*:*:*:*:* Versions es_3 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:es_4:*:*:*:*:*:*:* Versions es_4 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:ws_3:*:*:*:*:*:*:* Versions ws_3 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:ws_4:*:*:*:*:*:*:* Versions ws_4 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:5:*:client:*:*:*:*:* Versions 5 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop_workstation:5:*:client:*:*:*:*:* Versions 5 Running on ·Red Hat
- cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:* Versions 1 Running on ·Rpath
- cpe:2.3:o:suse:novell_linux_pos:9:*:*:*:*:*:*:* Versions 9 Running on ·SUSE
- cpe:2.3:o:suse:open_suse:10.2:*:*:*:*:*:*:* Versions 10.2 Running on ·SUSE
- cpe:2.3:o:suse:open_suse:10.3:*:*:*:*:*:*:* Versions 10.3 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:9.0:*:enterprise_server:*:*:*:*:* Versions 9.0 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:10:sp1:enterprise_desktop:*:*:*:*:* Versions 10 sp1 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:10:sp1:enterprise_server:*:*:*:*:* Versions 10 sp1 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:10.1:*:ppc:*:*:*:*:* Versions 10.1 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:10.1:*:x86:*:*:*:*:* Versions 10.1 Running on ·SUSE
- cpe:2.3:o:suse:suse_linux:10.1:*:x86_64:*:*:*:*:* Versions 10.1 Running on ·SUSE
- cpe:2.3:o:suse:suse_open_enterprise_server:0:*:*:*:*:*:*:* Versions 0 Running on ·SUSE
- cpe:2.3:a:ghostscript:ghostscript:*:*:*:*:*:*:*:* Versions up to 8.61 Vulnerable ·Ghostscript
- cpe:2.3:a:ghostscript:ghostscript:0:*:*:*:*:*:*:* Versions 0 Vulnerable ·Ghostscript
- cpe:2.3:a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Ghostscript
- cpe:2.3:a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:* Versions 8.15 Vulnerable ·Ghostscript
Remediation
Red Hat 1 advisory
- RHSA-2008:0155 Released 2008-02-27 · Red Hat rating Importantghostscript security update
- Red Hat Desktop version 3 ghostscript-7.05-32.1.13, ghostscript-7.05-32.1.13.i386, ghostscript-devel-7.05-32.1.13 +3
- Red Hat Enterprise Linux (v. 5 server) ghostscript-8.15.2-9.1.el5_1.1, ghostscript-8.15.2-9.1.el5_1.1.i386, ghostscript-8.15.2-9.1.el5_1.1.ia64 +9
- Red Hat Enterprise Linux AS version 3 ghostscript-7.05-32.1.13, ghostscript-7.05-32.1.13.i386, ghostscript-7.05-32.1.13.ia64 +9
- Red Hat Enterprise Linux AS version 4 ghostscript-7.07-33.2.el4_6.1, ghostscript-7.07-33.2.el4_6.1.i386, ghostscript-7.07-33.2.el4_6.1.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) ghostscript-8.15.2-9.1.el5_1.1, ghostscript-8.15.2-9.1.el5_1.1.i386, ghostscript-gtk-8.15.2-9.1.el5_1.1 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) ghostscript-8.15.2-9.1.el5_1.1, ghostscript-devel-8.15.2-9.1.el5_1.1, ghostscript-devel-8.15.2-9.1.el5_1.1.i386
- Red Hat Enterprise Linux Desktop version 4 ghostscript-7.07-33.2.el4_6.1, ghostscript-7.07-33.2.el4_6.1.i386, ghostscript-devel-7.07-33.2.el4_6.1 +3
- Red Hat Enterprise Linux ES version 3 ghostscript-7.05-32.1.13, ghostscript-7.05-32.1.13.i386, ghostscript-7.05-32.1.13.ia64 +6
- Red Hat Enterprise Linux ES version 4 ghostscript-7.07-33.2.el4_6.1, ghostscript-7.07-33.2.el4_6.1.i386, ghostscript-7.07-33.2.el4_6.1.ia64 +6
- Red Hat Enterprise Linux WS version 3 ghostscript-7.05-32.1.13, ghostscript-7.05-32.1.13.i386, ghostscript-7.05-32.1.13.ia64 +6
- Red Hat Enterprise Linux WS version 4 ghostscript-7.07-33.2.el4_6.1, ghostscript-7.07-33.2.el4_6.1.i386, ghostscript-7.07-33.2.el4_6.1.ia64 +6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Desktop version 3 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2008:0155 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2008:0155 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-0411
- 2026-10-03 Alias added: GHSA-3xp4-6gjh-55fh
References
Patch 2
More Ghostscript vulnerabilities
- TI-2009-04050 Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript… CVSS 2.0HIGH 9.3
- TI-2009-00183 Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c)… CVSS 2.0HIGH 9.3
- TI-2009-00560 Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format… CVSS 2.0HIGH 9.3
- TI-2009-00754 Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format… CVSS 2.0HIGH 9.3
- TI-2009-00561 icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in… CVSS 2.0HIGH 9.3
- TI-2007-06419 The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions… CVSS 2.0HIGH 7.5
Sources
- CVE-2008-0411 · CVE Program
- CVE-2008-0411 · NVD
- FIRST EPSS
- GHSA-3xp4-6gjh-55fh · GitHub Advisory Database · CC BY 4.0
- CVE-2008-0411 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences