CVE-2008-5317 Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "n...
HighCVSS 10.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| littlecms lcms | <= 1.16 | No fix listed |
| littlecms lcms | = 1.07 | No fix listed |
| littlecms lcms | = 1.08 | No fix listed |
| littlecms lcms | = 1.09 | No fix listed |
| littlecms lcms | = 1.10 | No fix listed |
| littlecms lcms | = 1.11 | No fix listed |
| littlecms lcms | = 1.12 | No fix listed |
| littlecms lcms | = 1.13 | No fix listed |
| littlecms lcms | = 1.14 | No fix listed |
| littlecms lcms | = 1.15 | No fix listed |
| littlecms little cms color engine | <= 1.16 | No fix listed |
| littlecms little cms color engine | = 1.07 | No fix listed |
| littlecms little cms color engine | = 1.08 | No fix listed |
| littlecms little cms color engine | = 1.09 | No fix listed |
| littlecms little cms color engine | = 1.10 | No fix listed |
| littlecms little cms color engine | = 1.11 | No fix listed |
| littlecms little cms color engine | = 1.12 | No fix listed |
| littlecms little cms color engine | = 1.13 | No fix listed |
| littlecms little cms color engine | = 1.14 | No fix listed |
| littlecms little cms color engine | = 1.15 | No fix listed |
References
- lcms.cvs.sourceforge.net patch
- 33066 third-party-advisory
- 33219 third-party-advisory
- DSA-1684 vendor-advisory
- [oss-security] 20081128 CVE request: lcms (old issues) mailing-list
- RHSA-2009:0011 vendor-advisory
- 32708 vdb-entry
- lcms-cmsallocgamma-bo(47120) vdb-entry
- oval:org.mitre.oval:def:10685 signature vdb-entry
- USN-693-1 vendor-advisory