CVE-2008-3863

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-10-23 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.

Affected products

GNU Enscript: 1.6.1, 1.6.4-beta

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
http://rhn.redhat.com/errata/RHSA-2008-1021.html
http://secunia.com/advisories/32137
http://secunia.com/advisories/32521
http://secunia.com/advisories/32530
http://secunia.com/advisories/32753
http://secunia.com/advisories/32854
http://secunia.com/advisories/32970
http://secunia.com/advisories/33109
http://secunia.com/advisories/35074
http://secunia.com/secunia_research/2008-41/

Get alerted when CVE-2008-3863 or the next vulnerability affects your stack