CVE-2008-5317

Published: Dec 3, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.

Affected (20)

Products: Littlecms: Lcms, Little Cms Color Engine

2 products

Little Cms Color Engine

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Littlecms Lcms	Up to 1.16
Littlecms Lcms	Version 1.07
Littlecms Lcms	Version 1.08
Littlecms Lcms	Version 1.09
Littlecms Lcms	Version 1.10
Littlecms Lcms	Version 1.11
Littlecms Lcms	Version 1.12
Littlecms Lcms	Version 1.13
Littlecms Lcms	Version 1.14
Littlecms Lcms	Version 1.15
Littlecms Little Cms Color Engine	Up to 1.16
Littlecms Little Cms Color Engine	Version 1.07
Littlecms Little Cms Color Engine	Version 1.08
Littlecms Little Cms Color Engine	Version 1.09
Littlecms Little Cms Color Engine	Version 1.10
Littlecms Little Cms Color Engine	Version 1.11
Littlecms Little Cms Color Engine	Version 1.12
Littlecms Little Cms Color Engine	Version 1.13
Littlecms Little Cms Color Engine	Version 1.14
Littlecms Little Cms Color Engine	Version 1.15

Related CWEs

References (20)

http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17

Source: cve@mitre.org

Patch

http://secunia.com/advisories/33066

Source: cve@mitre.org

http://secunia.com/advisories/33219

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1684

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/11/28/3

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0011.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/32708

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/47120

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10685

Source: cve@mitre.org

https://usn.ubuntu.com/693-1/

Source: cve@mitre.org

http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/33066

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33219

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2008/dsa-1684

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/11/28/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/32708

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/47120

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10685

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/693-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.