9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.053 Low
EPSS
Percentile
93.0%
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP and Firefox.
RedHat reported a null-pointer dereference flaw while processing monochrome ICC profiles (CVE-2009-0793).
Chris Evans of Google discovered the following vulnerabilities:
A remote attacker could entice a user or automated system to open a specially crafted file containing a malicious ICC profile, possibly resulting in the execution of arbitrary code with the privileges of the user running the application or memory exhaustion, leading to a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/lcms-1.18-r1"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | media-libs/lcms | < 1.18-r1 | UNKNOWN |