Description
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | argyll | 1.4.0-1 | — |
| Debian 13 | argyll | 1.4.0-1 | — |
| Debian 12 | argyll | 1.4.0-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | argyllcms | 1.8.3-1.4 | openSUSE-SU-2024:10284-1 |
Advisories 1
- openSUSE-SU-2024:10284-1 argyllcms-1.8.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- argyll-icc-code-execution(75162) vdb-entry
- 48921 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=809697
- 81617 vdb-entry
- http://www.argyllcms.com/icc_readme.html
- 53240 vdb-entry
- GLSA-201206-04 vendor-advisory
- FEDORA-2012-6529 vendor-advisory
- 49602 third-party-advisory