CVE-2013-4160
21.01.2014, 18:55
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.Enginsight
| Vendor | Product | Version |
|---|---|---|
| littlecms | little_cms_color_engine | 𝑥 ≤ 2.4 |
| littlecms | little_cms_color_engine | 1.07 |
| littlecms | little_cms_color_engine | 1.08 |
| littlecms | little_cms_color_engine | 1.09 |
| littlecms | little_cms_color_engine | 1.10 |
| littlecms | little_cms_color_engine | 1.11 |
| littlecms | little_cms_color_engine | 1.12 |
| littlecms | little_cms_color_engine | 1.13 |
| littlecms | little_cms_color_engine | 1.14 |
| littlecms | little_cms_color_engine | 1.15 |
| littlecms | little_cms_color_engine | 1.16 |
| littlecms | little_cms_color_engine | 1.17 |
| littlecms | little_cms_color_engine | 1.18 |
| littlecms | little_cms_color_engine | 1.19 |
| littlecms | little_cms_color_engine | 2.0 |
| littlecms | little_cms_color_engine | 2.1 |
| littlecms | little_cms_color_engine | 2.2 |
| littlecms | little_cms_color_engine | 2.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| ghostscript |
| ||||||||
| lcms |
| ||||||||
| lcms2 |
|
References