Description of problem:

The function gettext() in ps.c is vulnerable to a buffer overflow condition,
because it copies characters from input file to a fixed-sized array text[].

Version-Release number of selected component (if applicable):

gv-3.5.8

How reproducible:

With specially crafted files looking like either of those below this paragraph.
(Replace ... with something a bit longer than PSLINELENGTH (256), so it
overwrites stack. It can be potantially malicious code that might get executed
on functio return)

%!PS-Adobe-3.0
%%DocumentMedia: ...

%!PS-Adobe-3.0
%%DocumentPaperSizes: ...

%!PS-Adobe-3.0
%%EndComments
%%BeginDefaults
%%PageMedia: ...

%!PS-Adobe-3.0
%%EndComments
%%BeginSetup
%%PaperSize: ...

Alternatively use exploit attached to original advisory, which connects to
a TCP socket and opens a shell.

Additional info:

Ggv and kghostview seem not to contain the affected code.