CVE-2008-3863

NameCVE-2008-3863
DescriptionStack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1670-1
Debian Bugs506261

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
enscript (PTS)bookworm, buster, bullseye, sid1.6.5.90-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
enscriptsourceetch1.6.4-11.1DSA-1670-1
enscriptsource(unstable)1.6.4-13506261

Search for package or bug name: Reporting problems