CVE-2018-11556

HIGH

Littlecms Little Cms - Out-of-Bounds Write

Title source: rule
STIX 2.1

Description

tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/mm2/Little-CMS/issues/167

Scores

CVSS v3 7.8
EPSS 0.0020
EPSS Percentile 42.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
littlecms/little_cms 2.9
Published May 30, 2018
Tracked Since Feb 18, 2026