Description (CNA)
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack-buffer-overflow (SBO) in CIccCalculatorFunc::Apply() when processed via iccApplyNamedCmm. Under AddressSanitizer, the failure is reported as a 4-byte write stack-buffer-overflow in IccProfLib/IccMpeCalc.cpp:3873, reachable through the MPE calculator / curve set initialization path. This issue has been patched in version 2.3.1.6.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| InternationalColorConsortium / iccDEV | affected < 2.3.1.6 |
CWE
CWE-121
References
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6749-6859-wf96
- https://github.com/InternationalColorConsortium/iccDEV/issues/678
- https://github.com/InternationalColorConsortium/iccDEV/pull/694
ADP enrichment
No English description supplied.
No references supplied.