CVE-2018-16435
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-16435
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16435.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-16435
- Downstream
- Related
- Published
- 2018-09-04T00:29:02Z
- Modified
- 2025-09-30T07:30:51.572147Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.
- References
-
- https://access.redhat.com/errata/RHSA-2018:3004
- https://github.com/mm2/Little-CMS/commit/768f70ca405cd3159d990e962d54456773bb8cf8
- https://github.com/mm2/Little-CMS/issues/171
- https://lists.debian.org/debian-lts-announce/2018/09/msg00005.html
- https://security.gentoo.org/glsa/202105-18
- https://usn.ubuntu.com/3770-1/
- https://usn.ubuntu.com/3770-2/
- https://www.debian.org/security/2018/dsa-4284
Affected packages
Git / github.com/mm2/little-cms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mm2/little-cms
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
lcms2-2.*
lcms2-2.7
lcms2.*
lcms2.2
lcms2.2rc0
lcms2.2rc1
lcms2.2rc2
lcms2.3
lcms2.3rc1
lcms2.3rc2
lcms2.3rc3
lcms2.4
lcms2.4rc1
lcms2.4rc2
lcms2.5
lcms2.5rc1
lcms2.5rc2
lcms2.5rc3
lcms2.6
lcms2.6rc0
lcms2.6rc1
lcms2.6rc3
lcms2.7rc1
lcms2.7rc2
lcms2.7rc3
lcms2.8
lcms2.8rc2
lcms2.9
lcms2.9rc1