SOL9990 - icclib vulnerabilities CVE-2009-0583 and CVE-2009-0584

Description

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript’s International Color Consortium Format library (icclib). Using specially-crafted ICC profiles, an attacker could create a malicious PostScript or PDF file with embedded images which could cause Ghostscript to crash or, potentially, execute arbitrary code when opened by the victim.

Information about this advisory is available at the following locations:

Note: These links take you to a resource outside of AskF5, and it is possible that the documents may be removed without our knowledge.

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0583&gt;

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0584&gt;

F5 Product Development tracked this issue as CR118548 and CR119796 and it was fixed in BIG-IP 9.4.7 and 10.0.1. For more information about upgrading, refer to the BIG-IP LTM, ASM, GTM, Link Controller, PSM, or WebAccelerator release notes.

Additionally, this issue was fixed in BIGIP-10.0.0-5514.0-HF2 for BIG-IP 10.0.0. You may download this hotfix or later versions of the hotfix from the F5 Downloads site.

To view a list of the latest available hotfixes, refer to SOL9502: BIG-IP hotfix matrix.

For information about installing a hotfix, refer to SOL10025: Managing BIG-IP product hotfixes (10.x).

For information about the F5 hotfix policy, refer to SOL4918: Overview of F5 critical issue hotfix policy.