Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different vulnerability than CVE-2007-2741.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0011 advisory.

    [1.15-1.2.2.el5_2.2]
    - Fix Requires to ensure subpackages match the parent package

    [1.15-1.2.2.el5_2.1]
    - Fix insufficient input validation in ReadEmbeddedTextTag
    - Fix unsigned -> signed integer cast issue in cmsAllocGamma
    - Resolves: #473469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple insufficient input validation flaws were discovered in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened.
(CVE-2008-5316, CVE-2008-5317)

Updated lcms packages that resolve several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Little Color Management System (LittleCMS, or simply 'lcms') is a small-footprint, speed-optimized open source color management engine.

Multiple insufficient input validation flaws were discovered in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened.
(CVE-2008-5316, CVE-2008-5317)

Users of lcms should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using lcms library must be restarted for the update to take effect.

Chris Evans discovered that certain ICC operations in lcms were not correctly bounds-checked. If a user or automated system were tricked into processing an image with malicious ICC tags, a remote attacker could crash applications linked against liblcms1, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been found in lcms, a library and set of commandline utilities for image color management. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-5316     Inadequate enforcement of fixed-length buffer limits     allows an attacker to overflow a buffer on the stack,     potentially enabling the execution of arbitrary code     when a maliciously-crafted image is opened.

  - CVS-2008-5317

    An integer sign error in reading image gamma data could     allow an attacker to cause an under-sized buffer to be     allocated for subsequent image data, with unknown     consequences potentially including the execution of     arbitrary code if a maliciously-crafted image is opened.

ID	Name	Product	Family	Severity
67787	Oracle Linux 5 : lcms (ELSA-2009-0011)	Nessus	Oracle Linux Local Security Checks	critical
60512	Scientific Linux Security Update : lcms on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43725	CentOS 5 : lcms (CESA-2009:0011)	Nessus	CentOS Local Security Checks	critical
37333	Ubuntu 6.06 LTS : lcms vulnerability (USN-652-1)	Nessus	Ubuntu Local Security Checks	critical
35318	RHEL 5 : lcms (RHSA-2009:0011)	Nessus	Red Hat Local Security Checks	critical
35077	Debian DSA-1684-1 : lcms - multiple vulnerabilities	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2008-5316

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical