PT-2024-27997 · International Color Consortium · Demoiccmax

David Hoyt · Published 2024-06-16 · Updated 2024-07-03 · CVE-2024-38427

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions International Color Consortium DemoIccMAX versions prior to 85ce74e

Description A logic flaw exists in the CIccTagXmlProfileSequenceId::ParseXml function within IccTagXml.cpp, causing it to unconditionally return false. This issue is related to the IccXML/IccLibXML component.

Recommendations For International Color Consortium DemoIccMAX versions prior to 85ce74e, update to a version after 85ce74e to resolve the issue. As a temporary workaround, consider restricting the use of the CIccTagXmlProfileSequenceId::ParseXml function until a patch is available.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2024-38427

Affected Products

Demoiccmax

References · 5

• https://osv.dev/vulnerability/CVE-2024-38427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38427 · Security Note
• https://github.com/InternationalColorConsortium/DemoIccMAX/pull/66/commits/85ce74ef19fb0751c7e188b06daed22fe74c332c · Note
• https://github.com/InternationalColorConsortium/DemoIccMAX/pull/66 · Note
• https://t.me/cvenotify/83408 · Telegram Post