This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-16435 →

DEBIAN-CVE-2018-16435

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buf...

Original description

The description as published by the source.

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 lcms2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-3"}]}]

Debian:13 lcms2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-3"}]}]

Debian:14 lcms2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-3"}]}]

References

advisory security-tracker.debian.org