A heap-based buffer overflow in LittleCMS might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/lcms | * | < 2.10 | >= 2.10 |
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP, Firefox and Chromium.
It was discovered that LittleCMS (aka Little Color Management System) had an integer overflow in the AllocateDataSet function in cmscgats.c.
A remote attacker could entice a user or automated system to open a specially crafted file containing malicious color data, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.10"
Multiple buffer overflow flaws and a parser error in LittleCMS could cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/lcms | * | < 2.6-r1 | >= 2.6-r1 |
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP and Firefox.
Multiple stack-based buffer overflows and a profile parser error have been found in LittleCMS.
A remote attacker could entice a user or automated system to open a specially crafted file containing a malicious ICC profile, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.6-r1"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
NOTE: Gentoo has discontinued support for the LittleCMS 1.9 branch.
Multiple errors in LittleCMS allow for attacks including the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/lcms | * | < 1.18-r1 | >= 1.18-r1 |
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP and Firefox.
RedHat reported a null-pointer dereference flaw while processing monochrome ICC profiles (CVE-2009-0793).
Chris Evans of Google discovered the following vulnerabilities:
A remote attacker could entice a user or automated system to open a specially crafted file containing a malicious ICC profile, possibly resulting in the execution of arbitrary code with the privileges of the user running the application or memory exhaustion, leading to a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/lcms-1.18-r1"