PT-2013-1268 · Little Cms+1 · Little Cms+2

Pedro Ribeiro · Published 2013-08-26 · Updated 2024-06-15 · CVE-2013-4276

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LittleCMS versions 1.19 and earlier lcms versions prior to 2.6-r1

Description The issue concerns multiple stack-based buffer overflows in LittleCMS, allowing remote attackers to cause a denial of service via crafted files, such as ICC color profiles or TIFF images. This can lead to a crash of the system, disrupting the availability of protected information. The exploitation of these issues can be done remotely.

Recommendations For LittleCMS versions 1.19 and earlier: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For lcms versions prior to 2.6-r1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09774

CVE-2013-4276

MGASA-2013-0260

OPENSUSE-SU-2024:10340-1

SUSE-SU-2013_1743-1

Affected Products

Little Cms

Suse

Lcms

References · 25

• https://osv.dev/vulnerability/MGASA-2013-0260 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=991757 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=992975 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4276 · Security Note
• http://openwall.com/lists/oss-security/2013/08/22/3 · Patch
• https://advisories.mageia.org/MGASA-2013-0260.html · Security Note
• https://bdu.fstec.ru/vul/2015-09774 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718682 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10340-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4276 · Security Note
• https://usn.ubuntu.com/3770-2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00029.html · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• http://support.novell.com/security/cve/CVE-2013-4276.html · Note