Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade lcmsUpgrade lcms-develUpgrade python-lcms | Dec 1, 2016 | Dec 3, 2008 |
| Oracle_linux | — | Upgrade lcms-develUpgrade python-lcmsUpgrade lcms | Oct 16, 2024 | Dec 3, 2008 |
| Ubuntu | — | Upgrade liblcms1 | Nov 8, 2024 | Dec 3, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub