PT-2008-1053 · Little Cms+1 · Lcms+2
Published
2008-12-03
·
Updated
2018-10-03
·
CVE-2008-5317
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
lcms versions 1.15 through 1.16
lcms-devel versions 1.15 through 1.16
Description
The issue is related to multiple vulnerabilities in the lcms package, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A specific error, an integer signedness error in the
cmsAllocGamma function, allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.Recommendations
For lcms versions 1.15 through 1.16, update to version 1.17 or later to resolve the issue.
For lcms-devel versions 1.15 through 1.16, update to version 1.17 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
cmsAllocGamma function until a patch is available.Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Lcms
Lcms-Devel