Security
Security
A heap-based buffer overflow in LittleCMS might allow remote attackers to execute arbitrary code.
| Package | media-libs/lcms on all architectures |
|---|---|
| Affected versions | < 2.10 |
| Unaffected versions | >= 2.10 |
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP, Firefox and Chromium.
It was discovered that LittleCMS (aka Little Color Management System) had an integer overflow in the AllocateDataSet function in cmscgats.c.
A remote attacker could entice a user or automated system to open a specially crafted file containing malicious color data, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.10"
Release date
May 26, 2021
Latest revision
May 26, 2021: 1
Severity
normal
Exploitable
local, remote
Bugzilla entries