Fluid Attacks Database

Description

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
alpine v3.15	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.14	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.11	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.21	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.10	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.12	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
alpine v3.22	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1
debian 11	lcms2	>=0 <2.9-3	2.9-3
debian 13	lcms2	>=0 <2.9-3	2.9-3
alpine v3.13	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| =2.8-r1 \|\| =2.8-r2 \|\| =2.9-r0 \|\| >=0 <2.9-r1	2.9-r1

1-10 of 22

Aliases

1. CVE-2018-164352. NVD-2018-164353. OSV-ALPINE-2018-164354. OSV-2018-164355. OSV-DEBIAN-2018-164356. SECURITY-CVE-2018-164357. SECURITY-TRACKER-CVE-2018-16435

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.