CVE-2018-16435
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-16435
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-16435.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2018-16435
- Downstream
- Related
- Published
- 2018-09-04T00:29:02.183Z
- Modified
- 2025-11-14T07:54:57.918812Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.
- References
-
- https://access.redhat.com/errata/RHSA-2018:3004
- https://github.com/mm2/Little-CMS/commit/768f70ca405cd3159d990e962d54456773bb8cf8
- https://github.com/mm2/Little-CMS/issues/171
- https://lists.debian.org/debian-lts-announce/2018/09/msg00005.html
- https://security.gentoo.org/glsa/202105-18
- https://usn.ubuntu.com/3770-1/
- https://usn.ubuntu.com/3770-2/
- https://www.debian.org/security/2018/dsa-4284
Affected packages
Git / github.com/mm2/little-cms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mm2/little-cms
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
lcms2-2.*
lcms2-2.7
lcms2.*
lcms2.2
lcms2.2rc0
lcms2.2rc1
lcms2.2rc2
lcms2.3
lcms2.3rc1
lcms2.3rc2
lcms2.3rc3
lcms2.4
lcms2.4rc1
lcms2.4rc2
lcms2.5
lcms2.5rc1
lcms2.5rc2
lcms2.5rc3
lcms2.6
lcms2.6rc0
lcms2.6rc1
lcms2.6rc3
lcms2.7rc1
lcms2.7rc2
lcms2.7rc3
lcms2.8
lcms2.8rc2
lcms2.9
lcms2.9rc1
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"digest": {
"length": 495.0,
"function_hash": "289413441468416616139089740172043071606"
},
"id": "CVE-2018-16435-145ab397",
"target": {
"file": "src/cmscgats.c",
"function": "AllocateDataSet"
},
"signature_version": "v1",
"source": "https://github.com/mm2/little-cms/commit/768f70ca405cd3159d990e962d54456773bb8cf8",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"64461819997124482979106334286118280424",
"215041857296242105574815240746909299689",
"75106329927921068269574548044125513763",
"268625472409093130820740598677676587993",
"267438632354151732730819967558379999806",
"163551188216957160249149735703588185421",
"131517083498262472784063732309604051117"
]
},
"id": "CVE-2018-16435-8ca9d527",
"target": {
"file": "src/cmscgats.c"
},
"signature_version": "v1",
"source": "https://github.com/mm2/little-cms/commit/768f70ca405cd3159d990e962d54456773bb8cf8",
"deprecated": false
}
]