lcms2 - Out of Bounds Read Vulnerability
Summary
DLA-803-1: lcms2 - security update. Affects lcms2 versions < 2.2+git20110628-2.2+deb7u2. Fixed in 2.2+git20110628-2.2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lcms2 is an open-source library for color management. It provides functions for converting and manipulating colors, as well as handling ICC profiles. This vulnerability affects lcms2 version 2.2+git20110628-2.2+deb7u2 in Debian 7 Wheezy.
Vulnerability Detail
An out of bounds read vulnerability has been discovered in lcms2. This vulnerability can be exploited by an attacker using a specially-crafted ICC profile. By exploiting this vulnerability, an attacker can cause a heap memory leak or trigger a denial of service condition.
How To Fix
Minimum fixed version
2.2+git20110628-2.2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lcms2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The lcms2 library in Debian 7 Wheezy is vulnerable to an out of bounds read vulnerability. It is recommended to upgrade the lcms2 package to version 2.2+git20110628-2.2+deb7u2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lcms2 →
FAQ
lcms2 is an open-source library for color management.
An ICC profile is a file that describes the color attributes of a device or color space.
An out of bounds read vulnerability occurs when a program reads data from a memory location outside of the bounds of a buffer or array.
A heap memory leak occurs when a program allocates memory on the heap but fails to release it, leading to a gradual depletion of available memory.
A denial of service attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming it with a flood of malicious requests or by exploiting a vulnerability to cause a crash or freeze.
Related vulnerabilities
Recent vulnerabilities recorded for lcms2.
