Multiple integer overflows and multiple insufficient upper-bounds checks on certain variable sizes were originally discovered in the Ghostscript's International Color Consortium Format Library (icclib). It was found, the original patch, addressing this issue was incomplete.
Created attachment 338699 [details] Updated ghostscript-CVE-2009-0792.patch (adds checks for all 'floor' occurences)
Created attachment 338705 [details] Updated Argyllcms CVE-2009-0792 (all changes in one file) patch
argyllcms has now been built with this patch for rawhide, F-10 and F-9, and Bodhi updates for F-10 and F-9 have been created.
argyllcms-1.0.3-4.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
argyllcms-1.0.3-4.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:0421 https://rhn.redhat.com/errata/RHSA-2009-0421.html
ghostscript-8.63-3.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/ghostscript-8.63-3.fc9
ghostscript-8.63-6.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
ghostscript-8.63-3.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
Turns out I added the patch to argyllcms but failed to apply it. Built in rawhide, others are on their way. My apologies for the mixup. Rel-eng ticket filed for Freeze Exception. https://fedorahosted.org/rel-eng/ticket/1497
argyllcms-1.0.3-5.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/argyllcms-1.0.3-5.fc9
argyllcms-1.0.3-5.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/argyllcms-1.0.3-5.fc10
argyllcms-1.0.3-5.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
argyllcms-1.0.3-5.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.