Mission and Overview
NVD is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g. FISMA).
Resource Status
NVD contains:
CVE Vulnerabilities
39671
Checklists
129
US-CERT Alerts
187
US-CERT Vuln Notes
2351
OVAL Queries
2517
CPE Names
17905

Last updated: Sun Nov 22 17:29:49 EST 2009

CVE Publication rate: 9.67

Email List

NVD provides four mailing lists to the public. For information and subscription instructions please visit NVD Mailing Lists

Workload Index

Vulnerability Workload Index: 5.3

About Us
NVD is a product of the NIST Computer Security Division and is sponsored by the Department of Homeland Security's National Cyber Security Division. It supports the U.S. government multi-agency (OSD, DHS, NSA, DISA, and NIST) Information Security Automation Program. It is the U.S. government content repository for the Security Content Automation Protocol (SCAP).

National Cyber-Alert System

Vulnerability Summary for CVE-2006-5864

Original release date:11/11/2006
Last revised:09/05/2008
Source: US-CERT/NIST

Overview

Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1) DocumentMedia, (2) DocumentPaperSizes, and possibly (3) PageMedia and (4) PaperSize headers. NOTE: this issue can be exploited through other products that use gv such as evince.

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:5.1 (MEDIUM) (AV:N/AC:H/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 4.9
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: High
Authentication: Not required to exploit
Impact Type:Provides user account access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/07/2007)
Red Hat is aware of this issue and is tracking it via the following bug for Red Hat Enterprise Linux 2.1. This issue did not affect Red Hat Enterprise Linux 3 or 4. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215593 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#352825
Name: VU#352825
Hyperlink:http://www.kb.cert.org/vuls/id/352825
External Source: XF
Name: gnu-gv-buffer-overflow(30153)
Hyperlink:http://xforce.iss.net/xforce/xfdb/30153
External Source: BID
Name: 20978
Hyperlink:http://www.securityfocus.com/bid/20978
External Source: BUGTRAQ
Name: 20061112 Re: GNU gv Stack Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/451422/100/200/threaded
External Source: BUGTRAQ
Name: 20061109 GNU gv Stack Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/451057/100/0/threaded
External Source: SUSE
Name: SUSE-SR:2006:026
Hyperlink:http://www.novell.com/linux/security/advisories/2006_26_sr.html
External Source: VUPEN
Name: ADV-2006-4424
Type: Advisory
Hyperlink:http://www.frsirt.com/english/advisories/2006/4424
External Source: DEBIAN
Name: DSA-1214
Hyperlink:http://www.debian.org/security/2006/dsa-1214
External Source: GENTOO
Name: GLSA-200611-20
Hyperlink:http://security.gentoo.org/glsa/glsa-200611-20.xml
External Source: SECUNIA
Name: 23118
Hyperlink:http://secunia.com/advisories/23118
External Source: SECUNIA
Name: 23018
Hyperlink:http://secunia.com/advisories/23018
External Source: SECUNIA
Name: 23006
Hyperlink:http://secunia.com/advisories/23006
External Source: SECUNIA
Name: 22787
Type: Advisory
Hyperlink:http://secunia.com/advisories/22787
External Source: MANDRIVA
Name: MDKSA-2006:214
Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:214
External Source: CONFIRM
Name: https://issues.rpath.com/browse/RPL-850
Hyperlink:https://issues.rpath.com/browse/RPL-850
External Source: XF
Name: evince-postscript-bo(30555)
Hyperlink:http://xforce.iss.net/xforce/xfdb/30555
External Source: UBUNTU
Name: USN-390-3
Hyperlink:http://www.ubuntu.com/usn/usn-390-3
External Source: UBUNTU
Name: USN-390-2
Hyperlink:http://www.ubuntu.com/usn/usn-390-2
External Source: UBUNTU
Name: USN-390-1
Hyperlink:http://www.ubuntu.com/usn/usn-390-1
External Source: BUGTRAQ
Name: 20061128 evince buffer overflow exploit (gv)
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/452868/100/0/threaded
External Source: SUSE
Name: SUSE-SR:2006:029
Hyperlink:http://www.novell.com/linux/security/advisories/2006_29_sr.html
External Source: SUSE
Name: SUSE-SR:2006:028
Hyperlink:http://www.novell.com/linux/security/advisories/2006_28_sr.html
External Source: MANDRIVA
Name: MDKSA-2006:229
Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:229
External Source: MANDRIVA
Name: MDKSA-2006:214
Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:214
External Source: VUPEN
Name: ADV-2006-4747
Hyperlink:http://www.frsirt.com/english/advisories/2006/4747
External Source: DEBIAN
Name: DSA-1243
Hyperlink:http://www.debian.org/security/2006/dsa-1243
External Source: GENTOO
Name: GLSA-200704-06
Hyperlink:http://security.gentoo.org/glsa/glsa-200704-06.xml
External Source: GENTOO
Name: GLSA-200703-24
Hyperlink:http://security.gentoo.org/glsa/glsa-200703-24.xml
External Source: SECUNIA
Name: 24787
Hyperlink:http://secunia.com/advisories/24787
External Source: SECUNIA
Name: 24649
Hyperlink:http://secunia.com/advisories/24649
External Source: SECUNIA
Name: 23579
Hyperlink:http://secunia.com/advisories/23579
External Source: SECUNIA
Name: 23409
Hyperlink:http://secunia.com/advisories/23409
External Source: SECUNIA
Name: 23353
Hyperlink:http://secunia.com/advisories/23353
External Source: SECUNIA
Name: 23335
Hyperlink:http://secunia.com/advisories/23335
External Source: SECUNIA
Name: 23306
Hyperlink:http://secunia.com/advisories/23306
External Source: SECUNIA
Name: 23266
Hyperlink:http://secunia.com/advisories/23266
External Source: SECUNIA
Name: 23183
Hyperlink:http://secunia.com/advisories/23183
External Source: SECUNIA
Name: 23111
Hyperlink:http://secunia.com/advisories/23111
External Source: SECUNIA
Name: 22932
Hyperlink:http://secunia.com/advisories/22932
External Source: MILW0RM
Name: 2858
Hyperlink:http://milw0rm.com/exploits/2858
External Source: MANDRIVA
Name: MDKSA-2006:229
Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:229

Vulnerable software and versions

Nav control imageConfiguration 1
spacerNav control imageOR
spacerspacerNav control image* cpe:/a:gnu:gv:3.5.8
spacerspacerNav control image* cpe:/a:gnu:gv:3.6.0
spacerspacerNav control image* cpe:/a:gnu:gv:3.6.1
spacerspacerNav control image* cpe:/a:gnu:gv:3.6.2
* Denotes Vulnerable Software
* Changes related to vulnerability configurations

Technical Details

Vulnerability Type (View All)
CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5864