Read the docs
TI-2009-00183 Aliases CVE-2009-0196GHSA-76p8-fv4q-j2wv

Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c)…

Priority MEDIUM 50CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.

Why it matters now

EPSS 0.07433 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:ghostscript:ghostscript:*:*:*:*:*:*:*:*up to 8.64VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:0:*:*:*:*:*:*:*0VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:5.50:*:*:*:*:*:*:*5.50VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:7.07:*:*:*:*:*:*:*7.07VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:*8.15VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.15.2:*:*:*:*:*:*:*8.15.2VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.54:*:*:*:*:*:*:*8.54VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.56:*:*:*:*:*:*:*8.56VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.57:*:*:*:*:*:*:*8.57VulnerableGhostscript
  • cpe:2.3:a:ghostscript:ghostscript:*:*:*:*:*:*:*:* Versions up to 8.64 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:0:*:*:*:*:*:*:* Versions 0 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:5.50:*:*:*:*:*:*:* Versions 5.50 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:7.07:*:*:*:*:*:*:* Versions 7.07 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:* Versions 8.15 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.15.2:*:*:*:*:*:*:* Versions 8.15.2 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.54:*:*:*:*:*:*:* Versions 8.54 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Ghostscript
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ghostscript:ghostscript:8.60:*:*:*:*:*:*:*8.60VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.61:*:*:*:*:*:*:*8.61VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.62:*:*:*:*:*:*:*8.62VulnerableGhostscript
cpe:2.3:a:ghostscript:ghostscript:8.63:*:*:*:*:*:*:*8.63VulnerableGhostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.60:*:*:*:*:*:*:* Versions 8.60 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.61:*:*:*:*:*:*:* Versions 8.61 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.62:*:*:*:*:*:*:* Versions 8.62 Vulnerable ·Ghostscript
  • cpe:2.3:a:ghostscript:ghostscript:8.63:*:*:*:*:*:*:* Versions 8.63 Vulnerable ·Ghostscript

Remediation

Red Hat 1 advisory

  • RHSA-2009:0421 Released 2009-04-14 · Red Hat rating Moderate
    ghostscript security update
    • Red Hat Enterprise Linux (v. 5 server) ghostscript-8.15.2-9.4.el5_3.7, ghostscript-8.15.2-9.4.el5_3.7.i386, ghostscript-8.15.2-9.4.el5_3.7.ia64 +9
    • Red Hat Enterprise Linux Desktop (v. 5 client) ghostscript-8.15.2-9.4.el5_3.7, ghostscript-8.15.2-9.4.el5_3.7.i386, ghostscript-gtk-8.15.2-9.4.el5_3.7 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) ghostscript-8.15.2-9.4.el5_3.7, ghostscript-devel-8.15.2-9.4.el5_3.7, ghostscript-devel-8.15.2-9.4.el5_3.7.i386

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:0421
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:0421
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:0421

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0196
  2. 2026-10-03 Alias added: GHSA-76p8-fv4q-j2wv

References

Exploit 2

Advisory 10

Other 3

  • TI-2009-04050 Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript… CVSS 2.0HIGH 9.3
  • TI-2009-00560 Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format… CVSS 2.0HIGH 9.3
  • TI-2009-00754 Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format… CVSS 2.0HIGH 9.3
  • TI-2009-00561 icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in… CVSS 2.0HIGH 9.3
  • TI-2008-00386 Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61… CVSS 2.0MEDIUM 6.8
  • TI-2007-06419 The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions… CVSS 2.0HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences