CVE-2009-0733

LittleCMS <1.18beta2 - RCE

Title source: llm

Description

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.

References (41)

Core 41

Core References

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-744-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/49330

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:137

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34632

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34450

Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021869

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2009/dsa-1745

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34675

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34454

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34442

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html

Exploit x_refsource_misc

http://scary.beasts.org/security/CESA-2009-003.html

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34382

Third Party Advisory vendor-advisory x_refsource_slackware

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34418

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/502031/100/0/threaded

Third Party Advisory vendor-advisory x_refsource_redhat

https://rhn.redhat.com/errata/RHSA-2009-0377.html

Third Party Advisory x_refsource_misc

http://www.ocert.org/advisories/ocert-2009-003.html

Exploit x_refsource_misc

http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34782

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34367

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:162

Third Party Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-0339.html

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=487512

Broken Link vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/0775

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34463

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34408

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2009/dsa-1769

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34400

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:121

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/502018/100/0/threaded

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html

Tool Signature vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9742

Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/34185

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200904-19.xml

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html

Scores

EPSS 0.0186

EPSS Percentile 83.3%

Details

CWE

CWE-787

Status published

Products (4)

gimp/gimp < 2.9.2

littlecms/little_cms < 1.17

mozilla/firefox 3.1 beta1

sun/openjdk < 7

Published Mar 23, 2009

Tracked Since Feb 18, 2026