cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demoUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-src | Dec 1, 2016 | Apr 9, 2009 |
| Gentoo Linux | — | Upgrade media-libs/lcms. | Oct 30, 2017 | Apr 9, 2009 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-demo | Oct 16, 2024 | Apr 9, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 2, 2009 |
| Suse | — | Upgrade mozilla-xulrunner190-32bitUpgrade liblcms1-x86Upgrade mozilla-xulrunner190Upgrade liblcms-devel-32bitUpgrade mozilla-xulrunner190-x86Upgrade python-lcmsUpgrade lcmsUpgrade mozilla-xulrunner190-gnomevfsUpgrade liblcms-develUpgrade liblcms1-32bitUpgrade mozilla-xulrunner190-translationsUpgrade liblcms1 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade liblcms1 | Nov 8, 2024 | Apr 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub