CVE-2008-5316

Published: Dec 3, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different vulnerability than CVE-2007-2741.

Affected (18)

Products: Littlecms: Lcms, Little Cms Color Engine

2 products

Little Cms Color Engine

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Littlecms Lcms	version ≤ 1.15
Littlecms Lcms	Version 1.07
Littlecms Lcms	Version 1.08
Littlecms Lcms	Version 1.09
Littlecms Lcms	Version 1.10
Littlecms Lcms	Version 1.11
Littlecms Lcms	Version 1.12
Littlecms Lcms	Version 1.13
Littlecms Lcms	Version 1.14
Littlecms Little Cms Color Engine	version ≤ 1.15
Littlecms Little Cms Color Engine	Version 1.07
Littlecms Little Cms Color Engine	Version 1.08
Littlecms Little Cms Color Engine	Version 1.09
Littlecms Little Cms Color Engine	Version 1.10
Littlecms Little Cms Color Engine	Version 1.11
Littlecms Little Cms Color Engine	Version 1.12
Littlecms Little Cms Color Engine	Version 1.13
Littlecms Little Cms Color Engine	Version 1.14

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (16)

http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsio1.c?r1=1.33&r2=1.34

Source: cve@mitre.org

ExploitPatch

http://secunia.com/advisories/33066

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1684

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/11/28/3

Source: cve@mitre.org

Exploit

http://www.redhat.com/support/errata/RHSA-2009-0011.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/32708

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/47119

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10531

Source: cve@mitre.org

http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsio1.c?r1=1.33&r2=1.34

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://secunia.com/advisories/33066

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2008/dsa-1684

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/11/28/3

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.redhat.com/support/errata/RHSA-2009-0011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/32708

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/47119

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10531

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.