CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
java-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]
Bitnami
java
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]
Bitnami
jre
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2026-41254 lcms2 修正版: 2.19-r0
- BellSoft Alpaquita BELL-CVE-2026-41254 lcms2 修正版: 2.14-r1
- Debian DEBIAN-CVE-2026-41254 lcms2 修正版: 2.12~rc1-2+deb11u1
- Ubuntu UBUNTU-CVE-2026-41254 lcms2
参照URL
- advisory abhinavagarwal07.github.io
- advisory openwall.com
- patch github.com
- patch github.com
- web github.com
- web github.com
- web lists.debian.org
- web nvd.nist.gov
- web openjdk.org