Vulnerability CVE-2013-7455
Published: 2016-05-07

Description:
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Littlecms -> Little cms color engine 

 References:
http://www.kb.cert.org/vuls/id/369800
http://www.ubuntu.com/usn/USN-2961-1
https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
https://penteston.com/OSVDB-105462
Copyright 2024, cxsecurity.com

 

Back to Top