Little CMS (lcms2) through 2.18 has an integer overflow in C… (CVE-2026-41254)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami java-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]

Bitnami java

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]

Bitnami jre

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.501"},{"introduced":"9.0.0"},{"fixed":"11.0.32"},{"introduced":"12.0.0"},{"fixed":"17.0.20"},{"introduced":"18.0.0"},{"fixed":"21.0.12"},{"introduced":"22.0.0"},{"fixed":"25.0.4"},{"introduced":"26.0.0"},{"fixed":"26.0.2"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2026-41254 lcms2 Corrigé dans: 2.19-r0
BellSoft Alpaquita BELL-CVE-2026-41254 lcms2 Corrigé dans: 2.14-r1
Debian DEBIAN-CVE-2026-41254 lcms2 Corrigé dans: 2.12~rc1-2+deb11u1
Ubuntu UBUNTU-CVE-2026-41254 lcms2

Description d'origine

Paquets affectés

État des correctifs par distribution

Références