Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade java-17-openjdk-demoUpgrade java-1.8.0-openjdk-javadoc-zipUpgrade java-17-openjdk-src-slowdebugUpgrade java-1.8.0-openjdkUpgrade java-21-openjdk-demo-fastdebugUpgrade java-17-openjdk-javadoc-zipUpgrade java-1.8.0-openjdk-headless-slowdebugUpgrade java-21-openjdk-devel-slowdebugUpgrade java-17-openjdk-headlessUpgrade java-21-openjdk-static-libs-slowdebugUpgrade java-1.8.0-openjdk-headlessUpgrade java-21-openjdk-jmods-slowdebugUpgrade java-21-openjdk-src-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdkUpgrade java-21-openjdk-src-fastdebugUpgrade java-1.8.0-openjdk-fastdebugUpgrade java-1.8.0-openjdk-devel-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-17-openjdk-develUpgrade java-21-openjdk-headlessUpgrade java-21-openjdk-javadoc-zipUpgrade java-21-openjdk-javadocUpgrade java-1.8.0-openjdk-src-fastdebugUpgrade java-1.8.0-openjdk-accessibilityUpgrade java-17-openjdk-devel-fastdebugUpgrade java-1.8.0-openjdk-demo-slowdebugUpgrade java-1.8.0-openjdk-headless-fastdebugUpgrade java-21-openjdk-jmods-fastdebugUpgrade java-21-openjdk-headless-slowdebugUpgrade java-1.8.0-openjdk-accessibility-slowdebugUpgrade java-17-openjdk-src-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-21-openjdk-headless-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-1.8.0-openjdk-src-slowdebugUpgrade java-1.8.0-openjdk-srcUpgrade java-21-openjdk-devel-fastdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-srcUpgrade java-1.8.0-openjdk-demoUpgrade java-17-openjdk-javadocUpgrade java-21-openjdk-static-libsUpgrade java-21-openjdk-develUpgrade java-1.8.0-openjdk-develUpgrade java-1.8.0-openjdk-demo-fastdebugUpgrade java-17-openjdk-slowdebugUpgrade java-21-openjdk-jmodsUpgrade java-21-openjdk-fastdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-srcUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-21-openjdkUpgrade java-21-openjdk-demo-slowdebugUpgrade java-1.8.0-openjdk-accessibility-fastdebugUpgrade java-1.8.0-openjdk-devel-fastdebugUpgrade java-1.8.0-openjdk-slowdebugUpgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-static-libsUpgrade java-21-openjdk-slowdebugUpgrade java-17-openjdk-fastdebugUpgrade java-21-openjdk-static-libs-fastdebugUpgrade java-1.8.0-openjdk-javadocUpgrade java-21-openjdk-demo | Jul 26, 2026 | Jul 23, 2026 |
| Alpine Linux | — | Upgrade openjdk25Upgrade openjdk21Upgrade openjdk11Upgrade lcms2Upgrade openjdk17 | Apr 29, 2026 | Apr 18, 2026 |
| Amazon Linux Ami 2 | — | Upgrade lcms2Upgrade lcms2-develUpgrade lcms2-utilsUpgrade lcms2-debuginfo | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade lcms2Upgrade lcms2-debugsourceUpgrade lcms2-debuginfoUpgrade lcms2-develUpgrade lcms2-utilsUpgrade lcms2-utils-debuginfo | May 19, 2026 | Apr 18, 2026 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 25 installer 25.35.12 (JDK 25.0.3.0.101+1, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 26 installer 26.32.13 (JDK 26.0.2+10, PSU) (short-term support); migrate to JDK 25 (LTS)Upgrade to Azul Zulu JDK 21 installer 21.51.14 (JDK 21.0.11.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.89.14 (JDK 11.0.31.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.67.14 (JDK 17.0.19.0.101+1, quarterly CPU) (LTS stream)Apply legacy security update: Azul Zulu JDK 7 installer 7.87.0.14 (JDK 7u511-b01, quarterly CPU) — Azul Legacy Production SupportApply legacy security update: Azul Zulu JDK 6 installer 6.81.0.14 (JDK 6b181, quarterly CPU) — Azul Legacy Production SupportUpgrade to Azul Zulu JDK 8 installer 8.95.0.14 (JDK 8u501-b01, quarterly CPU) (LTS stream) | Jul 30, 2026 | Apr 18, 2026 |
| Debian | — | Upgrade openjdk-17Upgrade openjdk-21Upgrade openjdk-11Upgrade lcms2Upgrade openjdk-25 | May 10, 2026 | May 10, 2026 |
| Eclipseadoptium | — | — | Jul 24, 2026 | Apr 18, 2026 |
| Freebsd | — | Upgrade lcms2 | Apr 27, 2026 | Apr 26, 2026 |
| Ibm Aix | — | Apply the fix or workaround for aix_vios_advisory | Aug 16, 2026 | Aug 14, 2026 |
| Ibm Java | — | Upgrade IBM Java to version 8.0.8.70 | Apr 18, 2026 | Apr 18, 2026 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 18, 2026 | Apr 18, 2026 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 23, 2026 | Apr 18, 2026 |
| Redhat_linux | — | Upgrade java-1.8.0-openjdk-demo-fastdebug-debuginfoUpgrade java-1.8.0-openjdk-headless-fastdebugUpgrade java-21-ibm-semeru-certified-jdk-jmodsUpgrade java-21-openjdk-headlessUpgrade java-11-openjdk-demo-debugUpgrade java-25-openjdk-demoUpgrade java-1.8.0-openjdk-demoUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-11-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-fastdebugUpgrade java-11-openjdk-devel-fastdebugUpgrade java-11-openjdk-debuginfoUpgrade java-21-openjdk-static-libs-fastdebugUpgrade java-21-openjdk-src-fastdebugUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-21-openjdk-debugsourceUpgrade java-25-openjdk-crypto-adapter-slowdebugUpgrade java-11-openjdk-demo-fastdebugUpgrade java-17-openjdk-develUpgrade java-11-openjdk-demoUpgrade java-25-openjdk-crypto-adapter-slowdebug-debuginfoUpgrade java-21-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-src-slowdebugUpgrade java-11-openjdk-javadoc-zip-debugUpgrade java-11-openjdk-srcUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-demo-slowdebugUpgrade java-21-openjdk-demo-slowdebugUpgrade java-11-openjdk-headless-slowdebugUpgrade java-17-openjdk-devel-debuginfoUpgrade java-17-openjdk-static-libsUpgrade java-21-openjdk-slowdebugUpgrade java-11-openjdk-devel-slowdebugUpgrade java-11-openjdk-slowdebugUpgrade java-25-openjdk-develUpgrade java-21-openjdk-jmodsUpgrade java-1.8.0-openjdk-demo-slowdebugUpgrade java-25-openjdk-crypto-adapter-fastdebugUpgrade java-1.8.0-openjdk-headless-debuginfoUpgrade java-1.8.0-ibm-develUpgrade java-11-openjdk-src-debugUpgrade java-17-openjdk-javadoc-zipUpgrade java-11-openjdk-static-libs-debugUpgrade java-21-openjdk-develUpgrade java-17-openjdk-javadocUpgrade java-21-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-debugsourceUpgrade java-11-openjdk-slowdebug-debuginfoUpgrade java-25-openjdk-devel-fastdebug-debuginfoNo solution existsUpgrade java-21-openjdk-devel-slowdebugUpgrade java-21-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-headless-fastdebugUpgrade java-1.8.0-openjdk-devel-fastdebugUpgrade java-1.8.0-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-headless-fastdebugUpgrade java-11-openjdk-devel-fastdebug-debuginfoUpgrade java-17-openjdk-devel-slowdebugUpgrade java-1.8.0-openjdk-debuginfoUpgrade java-11-openjdkUpgrade java-25-openjdk-fastdebugUpgrade java-25-openjdk-javadocUpgrade java-1.8.0-ibmUpgrade java-21-openjdk-javadocUpgrade java-1.8.0-ibm-demoUpgrade java-21-openjdkUpgrade java-11-openjdk-devel-debugUpgrade java-21-openjdk-demo-fastdebugUpgrade java-11-openjdk-javadoc-debugUpgrade java-21-openjdk-javadoc-zipUpgrade java-11-openjdk-debugUpgrade java-1.8.0-openjdk-srcUpgrade java-25-openjdk-crypto-adapter-debuginfoUpgrade java-25-openjdk-src-fastdebugUpgrade java-1.8.0-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-demo-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-11-openjdk-static-libs-fastdebugUpgrade java-21-openjdk-demoUpgrade java-1.8.0-ibm-headlessUpgrade java-17-openjdk-debuginfoUpgrade java-1.8.0-ibm-jdbcUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-11-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-devel-debuginfoUpgrade java-25-openjdk-headless-fastdebugUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-javadocUpgrade java-25-openjdk-devel-slowdebugUpgrade java-11-openjdk-demo-slowdebugUpgrade java-11-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-devel-debuginfoUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-1.8.0-openjdk-src-fastdebugUpgrade java-17-openjdk-demoUpgrade java-1.8.0-openjdk-accessibility-fastdebugUpgrade java-17-openjdk-srcUpgrade java-11-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-crypto-adapterUpgrade java-1.8.0-openjdk-accessibility-slowdebugUpgrade java-25-openjdk-headlessUpgrade java-1.8.0-openjdk-headless-fastdebug-debuginfoUpgrade java-1.8.0-openjdk-develUpgrade java-25-openjdk-fastdebug-debuginfoUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdkUpgrade java-21-openjdk-srcUpgrade java-21-openjdk-headless-debuginfoUpgrade java-17-openjdk-headless-fastdebugUpgrade java-21-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-src-fastdebugUpgrade java-25-openjdk-devel-fastdebugUpgrade java-25-openjdk-debuginfoUpgrade java-17-openjdk-headless-debuginfoUpgrade java-17-openjdk-headlessUpgrade java-11-openjdk-headless-debugUpgrade java-11-openjdk-develUpgrade java-25-openjdk-jmodsUpgrade java-25-openjdk-demo-slowdebugUpgrade java-11-openjdk-static-libsUpgrade java-17-openjdk-debugsourceUpgrade java-21-openjdk-debuginfoUpgrade java-1.8.0-openjdk-devel-slowdebug-debuginfoUpgrade java-11-openjdk-headlessUpgrade java-1.8.0-openjdk-headless-slowdebugUpgrade java-11-openjdk-jmods-slowdebugUpgrade java-11-openjdk-debugsourceUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-11-openjdk-headless-debuginfoUpgrade java-25-openjdk-headless-slowdebugUpgrade java-21-openjdk-fastdebug-debuginfoUpgrade java-11-openjdk-jmods-fastdebugUpgrade java-11-openjdk-jmods-debugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-src-slowdebugUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-slowdebugUpgrade java-1.8.0-openjdk-javadoc-zipUpgrade java-25-openjdk-demo-fastdebugUpgrade java-1.8.0-openjdk-debugsourceUpgrade java-1.8.0-ibm-srcUpgrade java-25-openjdk-static-libsUpgrade java-21-openjdk-static-libsUpgrade java-25-openjdk-srcUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-javadoc-zipUpgrade java-1.8.0-openjdk-devel-fastdebug-debuginfoUpgrade java-1.8.0-openjdk-devel-debuginfoUpgrade java-21-openjdk-slowdebug-debuginfoUpgrade java-21-ibm-semeru-certified-jdkUpgrade java-17-openjdk-jmodsUpgrade java-1.8.0-openjdk-slowdebugUpgrade java-25-openjdk-headless-debuginfoUpgrade java-21-openjdk-jmods-fastdebugUpgrade java-21-ibm-semeru-certified-jdk-srcUpgrade java-1.8.0-openjdk-javadocUpgrade java-1.8.0-openjdk-headlessUpgrade java-21-openjdk-devel-fastdebugUpgrade java-1.8.0-openjdk-fastdebugUpgrade java-1.8.0-openjdk-demo-fastdebugUpgrade java-1.8.0-openjdk-accessibilityUpgrade java-1.8.0-openjdk-demo-debuginfoUpgrade java-1.8.0-openjdkUpgrade java-21-ibm-semeru-certified-jdk-headlessUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-11-openjdk-jmodsUpgrade java-11-openjdk-src-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-jmods-slowdebugUpgrade java-11-openjdk-devel-debuginfoUpgrade java-1.8.0-ibm-pluginUpgrade java-21-ibm-semeru-certified-jdk-develUpgrade java-25-openjdk-crypto-adapter-fastdebug-debuginfoUpgrade java-1.8.0-openjdk-devel-slowdebugUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-21-openjdk-headless-slowdebug-debuginfoUpgrade java-21-openjdk-src-slowdebugUpgrade java-21-openjdk-fastdebugUpgrade java-1.8.0-openjdk-fastdebug-debuginfoUpgrade java-21-openjdk-headless-slowdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-11-openjdk-javadoc-zipUpgrade java-1.8.0-ibm-webstartUpgrade java-1.8.0-openjdk-src-slowdebugUpgrade java-1.8.0-openjdk-demo-slowdebug-debuginfoUpgrade java-17-openjdkUpgrade java-17-openjdk-fastdebugUpgrade java-11-openjdk-src-fastdebugUpgrade java-11-openjdk-headless-fastdebug-debuginfo | Jul 17, 2026 | Apr 18, 2026 |
| Rocky_linux | — | Upgrade java-17-openjdk-srcUpgrade java-25-openjdk-fastdebugUpgrade java-17-openjdk-develUpgrade java-17-openjdk-devel-slowdebugUpgrade java-17-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-develUpgrade java-25-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-demo-slowdebugUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-crypto-adapter-slowdebug-debuginfoUpgrade java-17-openjdk-headless-debuginfoUpgrade java-25-openjdk-crypto-adapter-fastdebugUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-25-openjdk-debuginfoUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-crypto-adapter-debuginfoUpgrade java-17-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-demo-slowdebugUpgrade java-17-openjdk-slowdebugUpgrade java-17-openjdk-jmods-fastdebugUpgrade java-25-openjdk-headless-slowdebugUpgrade java-17-openjdk-headless-slowdebugUpgrade java-17-openjdk-static-libsUpgrade java-17-openjdk-headless-slowdebug-debuginfoUpgrade java-17-openjdk-javadoc-zipUpgrade java-25-openjdk-demoUpgrade java-25-openjdk-devel-slowdebugUpgrade java-17-openjdkUpgrade java-25-openjdk-devel-debuginfoUpgrade java-25-openjdk-crypto-adapter-slowdebugUpgrade java-17-openjdk-demoUpgrade java-25-openjdk-debugsourceUpgrade java-17-openjdk-devel-slowdebug-debuginfoUpgrade java-17-openjdk-devel-debuginfoUpgrade java-17-openjdk-demo-fastdebugUpgrade java-25-openjdk-src-fastdebugUpgrade java-17-openjdk-static-libs-fastdebugUpgrade java-17-openjdk-jmodsUpgrade java-17-openjdk-debugsourceUpgrade java-17-openjdk-headless-fastdebug-debuginfoUpgrade java-17-openjdk-src-slowdebugUpgrade java-17-openjdk-javadocUpgrade java-25-openjdk-javadocUpgrade java-25-openjdk-crypto-adapterUpgrade java-25-openjdkUpgrade java-25-openjdk-javadoc-zipUpgrade java-25-openjdk-demo-fastdebugUpgrade java-25-openjdk-slowdebugUpgrade java-17-openjdk-static-libs-slowdebugUpgrade java-17-openjdk-headless-fastdebugUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-jmodsUpgrade java-25-openjdk-headlessUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-crypto-adapter-fastdebug-debuginfoUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-fastdebug-debuginfoUpgrade java-17-openjdk-slowdebug-debuginfoUpgrade java-17-openjdk-headlessUpgrade java-17-openjdk-debuginfoUpgrade java-17-openjdk-src-fastdebugUpgrade java-17-openjdk-jmods-slowdebugUpgrade java-17-openjdk-fastdebugUpgrade java-17-openjdk-devel-fastdebugUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-devel-fastdebugUpgrade java-25-openjdk-srcUpgrade java-25-openjdk-headless-debuginfo | Jul 27, 2026 | Jul 26, 2026 |
| Ubuntu | — | Upgrade openjdk-17-jre-headlessUpgrade openjdk-21-jreUpgrade liblcms2-2Upgrade openjdk-25-crac-jre-headlessUpgrade openjdk-21-testsupportUpgrade openjdk-8-jdkUpgrade openjdk-25-jre-zeroUpgrade liblcms2-utils (Ubuntu Pro)Upgrade openjdk-11-jre-headlessUpgrade openjdk-26-jre-zeroUpgrade openjdk-8-jre-headlessUpgrade openjdk-25-crac-jdkUpgrade openjdk-26-jdk-headlessUpgrade openjdk-26-jre-headlessUpgrade openjdk-21-sourceUpgrade openjdk-17-crac-jreUpgrade openjdk-17-demoUpgrade openjdk-17-jdkUpgrade openjdk-11-jreUpgrade openjdk-11-jdk-headlessUpgrade openjdk-21-jre-headlessUpgrade openjdk-25-jdk-headlessUpgrade openjdk-8-jdk-headlessUpgrade openjdk-21-crac-jdk-headlessUpgrade openjdk-8-jre-zeroUpgrade openjdk-25-jreUpgrade openjdk-17-jre-zeroUpgrade openjdk-21-crac-jre-zeroUpgrade openjdk-17-crac-jre-headlessUpgrade openjdk-21-crac-jreUpgrade openjdk-17-crac-jdkUpgrade openjdk-25-crac-jdk-headlessUpgrade openjdk-21-crac-jre-headlessUpgrade openjdk-8-jre-jamvmUpgrade openjdk-8-jreUpgrade openjdk-26-jdkUpgrade liblcms2-utilsUpgrade liblcms2-dev (Ubuntu Pro)Upgrade openjdk-25-crac-jre-zeroUpgrade openjdk-17-jdk-headlessUpgrade openjdk-21-docUpgrade openjdk-17-jreUpgrade openjdk-11-jdkUpgrade openjdk-25-jre-headlessUpgrade openjdk-21-demoUpgrade openjdk-11-jre-zeroUpgrade liblcms2-2 (Ubuntu Pro)Upgrade openjdk-25-crac-jreUpgrade openjdk-17-sourceUpgrade openjdk-25-jdkUpgrade openjdk-21-crac-jdkUpgrade openjdk-21-jdkUpgrade openjdk-17-crac-jre-zeroUpgrade openjdk-26-jreUpgrade openjdk-21-jre-zeroUpgrade openjdk-17-crac-jdk-headlessUpgrade openjdk-21-jdk-headless | Apr 28, 2026 | Apr 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub