Description
Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | lcms | 1.15-1.1+etch1 | DSA-1684-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | lcms +2 | 1.15-1.2.2.el5_2.2 | RHSA-2009:0011 |
Advisories 2
- RHSA-2009:0011 Red Hat Security Advisory: lcms security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1684-1 lcms - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 33219 third-party-advisory
- 32708 vdb-entry
- 33066 third-party-advisory
- oval:org.mitre.oval:def:10685 vdb-entry signature
- DSA-1684 vendor-advisory
- http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17
- [oss-security] 20081128 CVE request: lcms (old issues) mailing-list
- lcms-cmsallocgamma-bo(47120) vdb-entry
- RHSA-2009:0011 vendor-advisory
- USN-693-1 vendor-advisory