CVE-2018-16435

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-16435
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-16435.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-16435
Downstream
Related
Published
2018-09-04T00:29:02Z
Modified
2025-07-01T05:30:08.895072Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

References

Affected packages

Alpine:v3.10 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.11 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.12 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.13 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.14 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.15 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.16 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.17 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.18 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.19 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.20 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.21 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.22 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.8 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Alpine:v3.9 / lcms2

Package

Name
lcms2
Purl
pkg:apk/alpine/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-r1

Affected versions

2.*

2.5-r0
2.6-r0
2.7-r0
2.7-r1
2.8-r0
2.8-r1
2.8-r2
2.9-r0

Debian:11 / lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/mm2/little-cms

Affected ranges

Type
GIT
Repo
https://github.com/mm2/little-cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
768f70ca405cd3159d990e962d54456773bb8cf8

Affected versions

lcms2-2.*

lcms2-2.7

lcms2.*

lcms2.2
lcms2.2rc0
lcms2.2rc1
lcms2.2rc2
lcms2.3
lcms2.3rc1
lcms2.3rc2
lcms2.3rc3
lcms2.4
lcms2.4rc1
lcms2.4rc2
lcms2.5
lcms2.5rc1
lcms2.5rc2
lcms2.5rc3
lcms2.6
lcms2.6rc0
lcms2.6rc1
lcms2.6rc3
lcms2.7rc1
lcms2.7rc2
lcms2.7rc3
lcms2.8
lcms2.8rc2
lcms2.9
lcms2.9rc1