CVE-2008-3863

NameCVE-2008-3863
DescriptionStack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1670-1
Debian Bugs506261

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
enscript (PTS)buster, bookworm, bullseye1.6.5.90-3fixed
sid, trixie1.6.5.90-3.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
enscriptsourceetch1.6.4-11.1DSA-1670-1
enscriptsource(unstable)1.6.4-13506261

Search for package or bug name: Reporting problems