ArgyllCMS: User-assisted execution of arbitrary code — GLSA 201206-04

A vulnerability has been found in ArgyllCMS which could allow attackers to execute arbitrary code.

Affected packages

media-gfx/argyllcms on all architectures
Affected versions < 1.4.0
Unaffected versions >= 1.4.0

Background

ArgyllCMS is an ICC compatible color management system that supports accurate ICC profile creation for scanners, cameras and film recorders.

Description

ArgyllCMS does not properly handle ICC profiles causing a use-after-free vulnerability.

Impact

A remote attacker could entice a user to open a specially crafted image file using ArgyllCMS, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All argyllcms users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-gfx/argyllcms-1.4.0"
 

References

Release date
June 18, 2012

Latest revision
June 18, 2012: 1

Severity
normal

Exploitable
remote

Bugzilla entries