CVE-2009-0581

Published: Mar 23, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.

Affected (4)

Products: Littlecms: Little Cms · Gimp: Gimp · Mozilla: Firefox · +1 more

Show all products

Littlecms: Little Cms · Gimp: Gimp · Mozilla: Firefox · Oracle: Openjdk

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Littlecms Little Cms	Up to 1.17

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Gimp Gimp	Before 2.9.2
Mozilla Firefox	Version 3.1 beta1
Oracle Openjdk	Up to 7

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (82)

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Source: secalert@redhat.com

Third Party Advisory

http://scary.beasts.org/security/CESA-2009-003.html

Source: secalert@redhat.com

Exploit

http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html

Source: secalert@redhat.com

Exploit

http://secunia.com/advisories/34367

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34382

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34400

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34408

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34418

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34442

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34450

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34454

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34463

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34632

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34675

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/34782

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-200904-19.xml

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1745

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1769

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:121

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2009:137

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2009:162

Source: secalert@redhat.com

Broken Link

http://www.ocert.org/advisories/ocert-2009-003.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-0339.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/502018/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/502031/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/34185

Source: secalert@redhat.com

PatchThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021870

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-744-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0775

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=487509

Source: secalert@redhat.com

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/49328

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023

Source: secalert@redhat.com

Tool Signature

https://rhn.redhat.com/errata/RHSA-2009-0377.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html