CVE-2012-1616: Use After Free
First published: Wed Apr 04 2012(Updated: )
A Use-after-free vulnerability was found in the way icclib, a library used for reading and writing of color profile files that conform to the International Color Consortium (ICC) Profile Format Specification, processed certain crafted ICC profile files. The ICC Profile Format is a cross-platform device profile format that can be used to translate color data created on one device into another device's native color space. A remote attacker could provide a specially crafted file and trick a local user into opening it, which could lead to arbitrary code execution with the privileges of the user running an application linked against icclib. Red Hat would like to thank Marc Schoenefeld for reporting this flaw.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Usualtool CMS | <=1.3.7 | |
| Usualtool CMS | =0.1.0 | |
| Usualtool CMS | =0.2.0 | |
| Usualtool CMS | =0.2.1 | |
| Usualtool CMS | =0.2.2 | |
| Usualtool CMS | =0.3.0 | |
| Usualtool CMS | =0.6.0 | |
| Usualtool CMS | =0.7.0-beta_8 | |
| Usualtool CMS | =1.0.0 | |
| Usualtool CMS | =1.0.2 | |
| Usualtool CMS | =1.0.3 | |
| Usualtool CMS | =1.0.4 | |
| Usualtool CMS | =1.1.0 | |
| Usualtool CMS | =1.1.1 | |
| Usualtool CMS | =1.2.0 | |
| Usualtool CMS | =1.3.0 | |
| Usualtool CMS | =1.3.1 | |
| Usualtool CMS | =1.3.2 | |
| Usualtool CMS | =1.3.3 | |
| Usualtool CMS | =1.3.4 | |
| Usualtool CMS | =1.3.5 | |
| Usualtool CMS | =1.3.6 | |
| Color Icclib | <=2.11 | |
| Color Icclib | =1.23 | |
| Color Icclib | =2.00 | |
| Color Icclib | =2.02 | |
| Color Icclib | =2.03 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079762.html
- http://secunia.com/advisories/48921
- http://secunia.com/advisories/49602
- http://security.gentoo.org/glsa/glsa-201206-04.xml
- http://www.argyllcms.com/icc_readme.html
- http://www.osvdb.org/81617
- http://www.securityfocus.com/bid/53240
- https://bugzilla.redhat.com/show_bug.cgi?id=809697
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75162
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=815317
Frequently Asked Questions
What is the severity of CVE-2012-1616?
CVE-2012-1616 is classified as a moderate severity vulnerability due to the potential for use-after-free exploits in affected applications.
How do I fix CVE-2012-1616?
To fix CVE-2012-1616, update the affected ArgyllCMS or icclib software to the patched version that addresses the vulnerability.
What software is affected by CVE-2012-1616?
CVE-2012-1616 affects multiple versions of ArgyllCMS and icclib software, especially versions prior to 1.3.7 for ArgyllCMS and 2.11 for icclib.
What type of vulnerability is CVE-2012-1616?
CVE-2012-1616 is a use-after-free vulnerability that occurs when the software improperly handles memory management of ICC profile files.
Can exploiting CVE-2012-1616 lead to system compromise?
Yes, exploiting CVE-2012-1616 may allow an attacker to execute arbitrary code, potentially leading to system compromise.
- collector/redhat-bugzilla
- alias/CVE-2012-1616
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/argyllcms
- canonical/usualtool cms
- version/usualtool cms/1.3.7
- version/usualtool cms/0.1.0
- version/usualtool cms/0.2.0
- version/usualtool cms/0.2.1
- version/usualtool cms/0.2.2
- version/usualtool cms/0.3.0
- version/usualtool cms/0.6.0
- version/usualtool cms/0.7.0-beta_8
- version/usualtool cms/1.0.0
- version/usualtool cms/1.0.2
- version/usualtool cms/1.0.3
- version/usualtool cms/1.0.4
- version/usualtool cms/1.1.0
- version/usualtool cms/1.1.1
- version/usualtool cms/1.2.0
- version/usualtool cms/1.3.0
- version/usualtool cms/1.3.1
- version/usualtool cms/1.3.2
- version/usualtool cms/1.3.3
- version/usualtool cms/1.3.4
- version/usualtool cms/1.3.5
- version/usualtool cms/1.3.6
- vendor/color
- canonical/color icclib
- version/color icclib/2.11
- version/color icclib/1.23
- version/color icclib/2.00
- version/color icclib/2.02
- version/color icclib/2.03