CVE-2018-16435

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

References

Affected packages

Git / github.com/mm2/Little-CMS

Affected ranges

Type

GIT

Repo

https://github.com/mm2/Little-CMS

Events

Introduced

Last affected

29b019fd8726da70f162c7ce193440fe1ec4236f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9"
        }
    ]
}

Type: GIT
Repo: https://github.com/mm2/little-cms
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

768f70ca405cd3159d990e962d54456773bb8cf8

Affected versions

lcms2-2.*

lcms2-2.7

lcms2.*

lcms2.2

lcms2.2rc0

lcms2.2rc1

lcms2.2rc2

lcms2.3

lcms2.3rc1

lcms2.3rc2

lcms2.3rc3

lcms2.4

lcms2.4rc1

lcms2.4rc2

lcms2.5

lcms2.5rc1

lcms2.5rc2

lcms2.5rc3

lcms2.6

lcms2.6rc0

lcms2.6rc1

lcms2.6rc3

lcms2.7rc1

lcms2.7rc2

lcms2.7rc3

lcms2.8

lcms2.8rc2

lcms2.9

lcms2.9rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16435.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]

vanir_signatures

[
    {
        "signature_version": "v1",
        "target": {
            "file": "src/cmscgats.c",
            "function": "AllocateDataSet"
        },
        "source": "https://github.com/mm2/little-cms/commit/768f70ca405cd3159d990e962d54456773bb8cf8",
        "deprecated": false,
        "digest": {
            "function_hash": "289413441468416616139089740172043071606",
            "length": 495.0
        },
        "id": "CVE-2018-16435-145ab397",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "src/cmscgats.c"
        },
        "source": "https://github.com/mm2/little-cms/commit/768f70ca405cd3159d990e962d54456773bb8cf8",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "64461819997124482979106334286118280424",
                "215041857296242105574815240746909299689",
                "75106329927921068269574548044125513763",
                "268625472409093130820740598677676587993",
                "267438632354151732730819967558379999806",
                "163551188216957160249149735703588185421",
                "131517083498262472784063732309604051117"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2018-16435-8ca9d527",
        "signature_type": "Line"
    }
]