CVE-2009-0723: Integer Overflow
Chris Evans discovered an integer overflow flaw in LittleCms. This flaw could potentially lead to arbitrary code execution in applications that use the system LittleCms library, or embed the source into their application.
Acknowledgements:
Red Hat would like to thank Chris Evans from the Google Security Team for reporting these issues.
Other sources
Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/lcmsto a version that resolves this vulnerability.Fixed in 0:1.18-0.1.beta1.el5_3.2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-0723?
CVE-2009-0723 has a high severity level due to its potential to allow arbitrary code execution via crafted image files.
How do I fix CVE-2009-0723?
To fix CVE-2009-0723, update LittleCMS to version 1.18beta2 or later, and ensure related software like Firefox and GIMP are updated to their latest versions.
Which software is affected by CVE-2009-0723?
CVE-2009-0723 affects multiple software packages, including LittleCMS versions prior to 1.18beta2, Firefox 3.1beta1, OpenJDK up to version 7, and GIMP versions before 2.9.3.
What causes CVE-2009-0723?
CVE-2009-0723 is caused by multiple integer overflows in LittleCMS that can lead to heap-based buffer overflows.
Can CVE-2009-0723 be exploited remotely?
Yes, CVE-2009-0723 can be exploited remotely by attackers through specially crafted image files.