Stack-based buffer overflow in lcms - CVE-2013-4276

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32034

Stack-based buffer overflow in lcms - CVE-2013-4276

Published: September 28, 2013 / Updated: July 28, 2020


Vulnerability identifier: #VU32034
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4276
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

lcms
lcms (Alpine package)
linux-firmware (Alpine package)

How to mitigate CVE-2013-4276

Update to version 2.5.

lcms - update to 2.5
lcms (Alpine package) - addressed in versions 1.19-r3, 1.19-r4
linux-firmware (Alpine package) - update to 20180615-r2

External References

Related Security Bulletins