USN-660-1: enscript vulnerability

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• enscript -

Details

Ulf Härnhammar discovered multiple stack overflows in enscript's handling of
special escape arguments. If a user or automated system were tricked into
processing a malicious file with the "-e" option enabled, a remote attacker
could execute arbitrary code or cause enscript to crash, possibly leading
to a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• enscript - 1.6.4-12ubuntu0.8.10.1

Ubuntu 8.04

• enscript - 1.6.4-12ubuntu0.8.04.1

Ubuntu 7.10

• enscript - 1.6.4-11ubuntu0.2

Ubuntu 6.06

• enscript - 1.6.4-7ubuntu0.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-3863
• CVE-2008-4306