CVE-2013-7455 - Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS

CVE-2013-7455

Summary

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a>

References

Vulnerable Configurations

cpe:2.3:a:littlecms:little_cms_color_engine:2.0:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.0:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.1:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.1:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.2:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.2:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.3:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.3:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.4:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.4:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.5:*:*:*:*:*:*:*
cpe:2.3:a:littlecms:little_cms_color_engine:2.5:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 01-12-2016 - 02:59)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

cert-vn	VU#369800
confirm	https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
misc	https://penteston.com/OSVDB-105462
ubuntu	USN-2961-1

Last major update

01-12-2016 - 02:59

Published

07-05-2016 - 10:59

Last modified

01-12-2016 - 02:59