Published: 03/12/2008 Updated: 03/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) prior to 1.17 allows malicious users to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
littlecms lcms 1.08
littlecms lcms 1.07
littlecms little cms color engine 1.14
littlecms little cms color engine 1.07
littlecms little cms color engine 1.15
littlecms lcms 1.12
littlecms lcms 1.11
littlecms little cms color engine 1.11
littlecms little cms color engine 1.10
littlecms lcms
littlecms lcms 1.14
littlecms lcms 1.13
littlecms little cms color engine 1.13
littlecms little cms color engine 1.12
littlecms lcms 1.15
littlecms little cms color engine
littlecms lcms 1.10
littlecms lcms 1.09
littlecms little cms color engine 1.09
littlecms little cms color engine 1.08

Synopsis Moderate: lcms security update Type/Severity Security Advisory: Moderate Topic Updated lcms packages that resolve several security issues are nowavailable for Red Hat Enterprise Linux 5This update has been rated as having moderate security impact by the RedHat Security Response Team Desc ...

Chris Evans discovered that certain ICC operations in lcms were not correctly bounds-checked If a user or automated system were tricked into processing an image with malicious ICC tags, a remote attacker could crash applications linked against liblcms1, leading to a denial of service, or possibly execute arbitrary code with user privileges ...

It was discovered that certain gamma operations in lcms were not correctly bounds-checked If a user or automated system were tricked into processing a malicious image, a remote attacker could crash applications linked against liblcms1, leading to a denial of service, or possibly execute arbitrary code with user privileges ...

Two vulnerabilities have been found in lcms, a library and set of commandline utilities for image color management The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-5316 Inadequate enforcement of fixed-length buffer limits allows an attacker to overflow a buffer on the stack, potentially enabling ...

CWE-189 http://www.openwall.com/lists/oss-security/2008/11/28/3 http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17 http://secunia.com/advisories/33066 http://www.securityfocus.com/bid/32708 http://www.debian.org/security/2008/dsa-1684 http://secunia.com/advisories/33219 http://www.redhat.com/support/errata/RHSA-2009-0011.html https://exchange.xforce.ibmcloud.com/vulnerabilities/47120 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10685 https://usn.ubuntu.com/693-1/https://access.redhat.com/errata/RHSA-2009:0011 https://nvd.nist.gov https://usn.ubuntu.com/652-1/

CVE-2008-5317

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect