CVE-2008-5316 Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length paramet...
HighCVSS 10.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different vulnerability than CVE-2007-2741.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| littlecms lcms | <= 1.15 | No fix listed |
| littlecms lcms | = 1.07 | No fix listed |
| littlecms lcms | = 1.08 | No fix listed |
| littlecms lcms | = 1.09 | No fix listed |
| littlecms lcms | = 1.10 | No fix listed |
| littlecms lcms | = 1.11 | No fix listed |
| littlecms lcms | = 1.12 | No fix listed |
| littlecms lcms | = 1.13 | No fix listed |
| littlecms lcms | = 1.14 | No fix listed |
| littlecms little cms color engine | <= 1.15 | No fix listed |
| littlecms little cms color engine | = 1.07 | No fix listed |
| littlecms little cms color engine | = 1.08 | No fix listed |
| littlecms little cms color engine | = 1.09 | No fix listed |
| littlecms little cms color engine | = 1.10 | No fix listed |
| littlecms little cms color engine | = 1.11 | No fix listed |
| littlecms little cms color engine | = 1.12 | No fix listed |
| littlecms little cms color engine | = 1.13 | No fix listed |
| littlecms little cms color engine | = 1.14 | No fix listed |
References
- lcms.cvs.sourceforge.net exploit patch
- 33066 third-party-advisory
- DSA-1684 vendor-advisory
- [oss-security] 20081128 CVE request: lcms (old issues) exploit mailing-list
- RHSA-2009:0011 vendor-advisory
- 32708 vdb-entry
- lcms-readembeddedtexttag-bo(47119) vdb-entry
- oval:org.mitre.oval:def:10531 signature vdb-entry