CVE-2009-0793

2009-04-0900:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.053 Low

EPSS

Percentile

93.0%

JSON

cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and
other products, allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted image that
triggers execution of incorrect code for “transformations of monochrome
profiles.”

Bugs

Notes

Author	Note
mdeslaur	as per upstream post to lcms-user: No code injection can be done using this bug. Using monochrome profiles is rare, and using them in the output direction is a corner case. This bug is only exploitable if the application uses monochrome output, and then the crafted profile should be in the output direction. Does not affect input profiles, so an attacker could NOT use this flaw by creating a specially-crafted image.

Author

Note

mdeslaur

as per upstream post to lcms-user: No code injection can be done using this bug. Using monochrome profiles is rare, and using them in the output direction is a corner case. This bug is only exploitable if the application uses monochrome output, and then the crafted profile should be in the output direction. Does not affect input profiles, so an attacker could NOT use this flaw by creating a specially-crafted image.

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchlcms< 1.16-7ubuntu1.3UNKNOWN
ubuntu9.10noarchlcms< 1.18.dfsg-1ubuntu1.1UNKNOWN
ubuntu10.04noarchlcms< 1.18.dfsg-1ubuntu2.10.04.1UNKNOWN
ubuntu10.10noarchlcms< 1.18.dfsg-1ubuntu2.10.10.1UNKNOWN
ubuntu8.04noarchopenjdk-6< 6b18-1.8.2-4ubuntu1~8.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	lcms	< 1.16-7ubuntu1.3	UNKNOWN
ubuntu	9.10	noarch	lcms	< 1.18.dfsg-1ubuntu1.1	UNKNOWN
ubuntu	10.04	noarch	lcms	< 1.18.dfsg-1ubuntu2.10.04.1	UNKNOWN
ubuntu	10.10	noarch	lcms	< 1.18.dfsg-1ubuntu2.10.10.1	UNKNOWN
ubuntu	8.04	noarch	openjdk-6	< 6b18-1.8.2-4ubuntu1~8.04.1	UNKNOWN