Ubuntu.comUB:CVE-2013-4160CVE-2013-4160
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.6%
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other
products, allows remote attackers to cause a denial of service (NULL
pointer dereference and crash) via vectors related to (1)
cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3)
cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.
Bugs
Notes
| Author | Note |
|---|---|
| jdstrand | OpenJDK issue 8007925 does not affect lcms (code not present) OpenJDK issue 8007926 does not affect lcms (code not present) OpenJDK issue 8007927 does not affect lcms (code not present) OpenJDK issue 8007929 does not affect lcms (code not present) OpenJDK issue 8009654 does not affect lcms (code not present) |
References
www.openwall.com/lists/oss-security/2013/07/22
bugzilla.novell.com/show_bug.cgi?id=826097#c9
github.com/mm2/Little-CMS/commit/91c2db7f2559be504211b283bc3a2c631d6f06d9
launchpad.net/bugs/cve/CVE-2013-4160
nvd.nist.gov/vuln/detail/CVE-2013-4160
security-tracker.debian.org/tracker/CVE-2013-4160
ubuntu.com/security/notices/USN-1911-1
ubuntu.com/security/notices/USN-1911-2
www.cve.org/CVERecord?id=CVE-2013-4160
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.6%