Little CMS ICC Profile Stack Buffer Overflow Vulnerability

Little CMS ICC Profile Stack Buffer Overflow Vulnerability

Little CMS is prone to a remote stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. This issue stems from an error in LCMS when parsing ICC profiles.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected library. Failed exploits attempts will likely result in denial-of-service conditions.

Versions prior to Little CMS 1.15 are vulnerable to this issue.