A heap-based buffer overflow in LittleCMS might allow remote attackers to execute arbitrary code.
|Package||media-libs/lcms on all architectures|
|Affected versions||< 2.10|
|Unaffected versions||>= 2.10|
LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP, Firefox and Chromium.
It was discovered that LittleCMS (aka Little Color Management System) had an integer overflow in the AllocateDataSet function in cmscgats.c.
A remote attacker could entice a user or automated system to open a specially crafted file containing malicious color data, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All LittleCMS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.10"
May 26, 2021
May 26, 2021: 1