Name: CVE-2018-16435: Integer Overflow or Wraparound
Published: 2018-09-04T00:00:00.000Z
Keywords: CVE, CVE-2018-16435, CWE-190, CWE-787, CVSS 5.5, EPSS 0.01746

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	View advisory ↗View advisory ↗	alpine-linux-upgrade-lcms2alpine-linux-upgrade-openjdk8	Nov 9, 2018	Sep 4, 2018
Centos_linux	—	centos-upgrade-chromium-browsercentos-upgrade-chromium-browser-debuginfo	Aug 28, 2019	Sep 4, 2018
Debian	View advisory ↗	debian-upgrade-lcms2	Sep 6, 2018	Sep 3, 2018
Gentoo Linux	View advisory ↗	gentoo-linux-upgrade-media-libs-lcms	May 28, 2021	Sep 4, 2018
Huawei Euleros 2_0_sp2	View advisory ↗	huawei-euleros-2_0_sp2-upgrade-lcms2	Feb 22, 2021	Sep 4, 2018
Huawei Euleros 2_0_sp3	View advisory ↗	huawei-euleros-2_0_sp3-upgrade-lcms2	Jan 20, 2021	Sep 4, 2018
Huawei Euleros 2_0_sp5	View advisory ↗	huawei-euleros-2_0_sp5-upgrade-lcms2	Nov 2, 2020	Sep 4, 2018
Redhat_linux	View advisory ↗	no-fix-redhat-rpm-packageredhat-upgrade-chromium-browserredhat-upgrade-chromium-browser-debuginfo	Oct 25, 2018	Sep 3, 2018
Suse	—	suse-upgrade-java-1_7_0-openjdksuse-upgrade-java-1_7_0-openjdk-demosuse-upgrade-java-1_7_0-openjdk-develsuse-upgrade-java-1_7_0-openjdk-headlesssuse-upgrade-java-1_8_0-openjdksuse-upgrade-java-1_8_0-openjdk-accessibilitysuse-upgrade-java-1_8_0-openjdk-demosuse-upgrade-java-1_8_0-openjdk-develsuse-upgrade-java-1_8_0-openjdk-headlesssuse-upgrade-java-1_8_0-openjdk-javadocsuse-upgrade-java-1_8_0-openjdk-srcsuse-upgrade-lcms2suse-upgrade-liblcms2-2suse-upgrade-liblcms2-2-32bitsuse-upgrade-liblcms2-develsuse-upgrade-liblcms2-devel-32bitsuse-upgrade-liblcms2-doc	Oct 28, 2018	Sep 3, 2018
Ubuntu	View advisory ↗	ubuntu-upgrade-liblcms-utilsubuntu-upgrade-liblcms1ubuntu-upgrade-liblcms2-2ubuntu-upgrade-liblcms2-utils	Oct 2, 2018	Sep 3, 2018

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub