CVE-2009-0733: Buffer Overflow

Published Feb 26, 2009
·
Updated

Chris Evans discovered a flaw in how LittleCms checks certain upper-bounds sizes. This flaw could potentially lead to arbitrary code execution in applications that use the system LittleCms library, or embed the source into their application.

Acknowledgements:

Red Hat would like to thank Chris Evans from the Google Security Team for reporting these issues.

Other sources

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUTA2B and ReadLUTB2A functions.

Red Hat

Affected Software

7 affected componentsFixes available
redhat/lcms<0:1.18-0.1.beta1.el5_3.2
0:1.18-0.1.beta1.el5_3.2
redhat/java<1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5
1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5
Mozilla Firefox=3.1-beta1
GIMP GIMP
Sun OpenJDK<=7
LittleCms Little Cms<=1.17
GIMP GIMP<2.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/lcms to a version that resolves this vulnerability.

    Fixed in 0:1.18-0.1.beta1.el5_3.2
  2. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5

Event History

Feb 26, 2009
Data Sourced
via Red Hat·02:00 PM
DescriptionSeverityAffected Software
Mar 19, 2009
CVE Published
via Red Hat·12:00 AM
Mar 23, 2009
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:19 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2009-0733?

CVE-2009-0733 is classified as a critical vulnerability due to the potential for arbitrary code execution.

2

How do I fix CVE-2009-0733?

Fix CVE-2009-0733 by upgrading to LittleCMS version 1.18beta2 or later, or by applying relevant patches from your software vendor.

3

Which applications are affected by CVE-2009-0733?

CVE-2009-0733 affects multiple applications including Firefox 3.1beta, GIMP, and versions of OpenJDK before 7.

4

Can CVE-2009-0733 be exploited remotely?

Yes, CVE-2009-0733 can be exploited remotely by attackers through specially crafted image files.

5

Is CVE-2009-0733 still a risk for current systems?

CVE-2009-0733 is less of a risk for current systems that have been updated to exclude the vulnerable versions, but it is important to remain vigilant.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203