oss-security - ghostscript CVE for multiple NULL dereferences in JBIG2 decoder

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 26 Oct 2009 15:46:55 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: ghostscript CVE for multiple NULL dereferences in JBIG2 decoder

I'm not sure if a CVE name has ever been requested for this issue.
Similar to Adobe's CVE-2009-0658 issue, the same PDF proof-of-concept
was used to crash ghostscript (multiple NULL pointer dereference flaws
found in Ghostscript's JBIG2 compression format decoder).

If a CVE name was assigned for this, does anyone know it?  I can't find
it.  If not, could one be assigned?  Details are available on our
bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=503785

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.