cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-devel | Dec 1, 2016 | Apr 9, 2009 |
| Gentoo Linux | — | Upgrade media-libs/lcms. | Oct 30, 2017 | Apr 9, 2009 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk | Oct 16, 2024 | Apr 9, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 2, 2009 |
| Suse | — | Upgrade liblcms-develUpgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner190-translationsUpgrade liblcms1-32bitUpgrade liblcms1Upgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-x86Upgrade lcmsUpgrade mozilla-xulrunner190-32bitUpgrade liblcms-devel-32bitUpgrade python-lcmsUpgrade liblcms1-x86 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade liblcms1 | Nov 8, 2024 | Apr 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub