CVE-2009-0581: Medium severity LittleCms Little Cms vulnerability
Chris Evans discovered a memory leak flaw in LittleCms. This flaw could cause applications that use the system LittleCms library, or embed the source into their application, to crash.
Acknowledgements:
Red Hat would like to thank Chris Evans from the Google Security Team for reporting this issue.
Other sources
Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/lcmsto a version that resolves this vulnerability.Fixed in 0:1.18-0.1.beta1.el5_3.2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-0581?
CVE-2009-0581 has a severity rating that indicates a potential denial of service due to a memory leak.
How do I fix CVE-2009-0581?
To fix CVE-2009-0581, update LittleCMS to version 1.18beta2 or later, or apply the appropriate security patches for affected software.
Which software is affected by CVE-2009-0581?
CVE-2009-0581 affects software such as Firefox 3.1beta1, OpenJDK versions up to 7, and GIMP versions below 2.9.2.
What does CVE-2009-0581 exploit?
CVE-2009-0581 exploits a memory leak in LittleCMS that can be triggered by specially crafted image files.
Can CVE-2009-0581 lead to application crashes?
Yes, CVE-2009-0581 can lead to application crashes due to excessive memory consumption.