LittleCMS: User-assisted execution of arbitrary code

LittleCMS: User-assisted execution of arbitrary code A heap-based buffer overflow in LittleCMS might allow remote attackers to execute arbitrary code. lcms 2021-05-26 2021-05-26 761418 local, remote 2.10 2.10

LittleCMS, or short lcms, is a color management system for working with ICC profiles. It is used by many applications including GIMP, Firefox and Chromium.

It was discovered that LittleCMS (aka Little Color Management System) had an integer overflow in the AllocateDataSet function in cmscgats.c.

A remote attacker could entice a user or automated system to open a specially crafted file containing malicious color data, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

There is no known workaround at this time.

All LittleCMS users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=media-libs/lcms-2.10"

CVE-2018-16435 whissi whissi