CVE-2013-4160: Null Pointer Dereference

Q: What is the severity of CVE-2013-4160?

CVE-2013-4160 has been classified as a denial of service vulnerability due to a NULL pointer dereference leading to application crashes.

Q: How do I fix CVE-2013-4160?

To mitigate CVE-2013-4160, upgrade Little CMS to version 2.5 or later, which contains the necessary patches.

Q: Which versions of Little CMS are affected by CVE-2013-4160?

CVE-2013-4160 affects Little CMS versions prior to 2.5, including versions 1.07 to 2.4.

Q: Can CVE-2013-4160 be exploited remotely?

Yes, CVE-2013-4160 can be exploited by remote attackers to cause system crashes.

Q: Is there a known workaround for CVE-2013-4160?

There are no documented workarounds for CVE-2013-4160 other than upgrading to a patched version.

Published Jan 21, 2014

Updated

Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.

Affected Software

18 affected components

LittleCms Little Cms Color Engine<=2.4

LittleCms Little Cms Color Engine=1.07

LittleCms Little Cms Color Engine=1.08

LittleCms Little Cms Color Engine=1.09

LittleCms Little Cms Color Engine=1.10

LittleCms Little Cms Color Engine=1.11

LittleCms Little Cms Color Engine=1.12

LittleCms Little Cms Color Engine=1.13

LittleCms Little Cms Color Engine=1.14

LittleCms Little Cms Color Engine=1.15

LittleCms Little Cms Color Engine=1.16

LittleCms Little Cms Color Engine=1.17

LittleCms Little Cms Color Engine=1.18

LittleCms Little Cms Color Engine=1.19

LittleCms Little Cms Color Engine=2.0

LittleCms Little Cms Color Engine=2.1

LittleCms Little Cms Color Engine=2.2

LittleCms Little Cms Color Engine=2.3

Event History

Jan 21, 2014

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-4160?

CVE-2013-4160 has been classified as a denial of service vulnerability due to a NULL pointer dereference leading to application crashes.

How do I fix CVE-2013-4160?

To mitigate CVE-2013-4160, upgrade Little CMS to version 2.5 or later, which contains the necessary patches.

Which versions of Little CMS are affected by CVE-2013-4160?

CVE-2013-4160 affects Little CMS versions prior to 2.5, including versions 1.07 to 2.4.

Can CVE-2013-4160 be exploited remotely?

Yes, CVE-2013-4160 can be exploited by remote attackers to cause system crashes.

Is there a known workaround for CVE-2013-4160?