CVE-2018-16435 - CVE House
Back to Database
Status published Medium CVE-2018-16435

Little CMS (aka Little Color Management System) 2.9 has an...

Vulnerability Description

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16435

Credits & Attribution

No credits recorded in the NVD database.

References

More from littlecms

View All →
CVE-2018-11556
tificc in Little CMS 2.9 has an out-of-bounds write in...
High 7.8
CVE-2018-11555
tificc in Little CMS 2.9 has an out-of-bounds write in...
High 7.8
CVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2)...
High 7.1
CVE-2013-7455
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in...
Critical 9.8
CVE-2013-4276
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms)...
Medium 4.3

Affected Vendor

Affected Software

little cms color engine, ubuntu linux, enterprise linux desktop, enterprise linux server, enterprise linux workstation, debian linux
Vulnerable Versions:
2.9, 12.04, 14.04, 16.04, 18.04, 6.0, 8.0, 9.0

Timeline

Official Publish: September 4th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.