Veracode Vulnerability DatabaseVERACODE:23557Arbitrary Code Execution
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
lcms is vulnerable to arbitrary code execution. The vulnerability exists in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially-crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened.
| CPE | Name | Operator | Version |
|---|---|---|---|
| java-1.6.0-openjdk | eq | 1.6.0.0__0.25.b09.el5 | |
| lcms | eq | 1.15__1.2.2.el5_2.2 |
References
blogs.sun.com/security/entry/advance_notification_of_security_updates4
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
scary.beasts.org/security/CESA-2009-003.html
scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html
secunia.com/advisories/34367
secunia.com/advisories/34382
secunia.com/advisories/34400
secunia.com/advisories/34408
secunia.com/advisories/34418
secunia.com/advisories/34442
secunia.com/advisories/34450
secunia.com/advisories/34454
secunia.com/advisories/34463
secunia.com/advisories/34632
secunia.com/advisories/34675
secunia.com/advisories/34782
security.gentoo.org/glsa/glsa-200904-19.xml
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438
www.debian.org/security/2009/dsa-1745
www.debian.org/security/2009/dsa-1769
www.mandriva.com/security/advisories?name=MDVSA-2009:121
www.mandriva.com/security/advisories?name=MDVSA-2009:137
www.mandriva.com/security/advisories?name=MDVSA-2009:162
www.ocert.org/advisories/ocert-2009-003.html
www.redhat.com/security/updates/classification/#important
www.redhat.com/support/errata/RHSA-2009-0339.html
www.securityfocus.com/archive/1/502018/100/0/threaded
www.securityfocus.com/archive/1/502031/100/0/threaded
www.securityfocus.com/bid/34185
www.securitytracker.com/id?1021869
www.ubuntu.com/usn/USN-744-1
www.vupen.com/english/advisories/2009/0775
access.redhat.com/errata/RHSA-2009:0377
bugzilla.redhat.com/show_bug.cgi?id=487512
exchange.xforce.ibmcloud.com/vulnerabilities/49330
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9742
rhn.redhat.com/errata/RHSA-2009-0377.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html
www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html
Related
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C