PT-2018-10664 · Little Cms+1 · Little Cms+1

Xiaoqx · Publicado 2018-05-30 · Atualizado 2024-08-05 · CVE-2018-11556

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Little CMS version 2.9

Description The issue is related to an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a, which can be triggered via a crafted TIFF file. However, the Little CMS developers do not consider this a vulnerability in the lcms2 library itself, as it depends on LIBTIFF only for building sample programs and the issue cannot be reproduced on the lcms2 library.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALT-PU-2020-2055

CVE-2018-11556

Produtos afetados

Alt Linux

Little Cms

Referências · 11

• 🔥 https://github.com/xiaoqx/pocs/tree/master/cms · Exploit
• https://github.com/mm2/Little-CMS/issues/171 · Nota
• https://github.com/mm2/Little-CMS/issues/167 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2018-11556 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11555 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2020-2055 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-11556 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00426 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-11556 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11556 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16435 · Nota de Segurança