CVE-2013-7455: Double Free
Published May 7, 2016
·Updated
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
Affected Software
6 affected components
LittleCms Little Cms Color Engine=2.0
LittleCms Little Cms Color Engine=2.1
LittleCms Little Cms Color Engine=2.2
LittleCms Little Cms Color Engine=2.3
LittleCms Little Cms Color Engine=2.4
LittleCms Little Cms Color Engine=2.5
Event History
May 7, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-7455?
CVE-2013-7455 is considered a critical vulnerability as it allows remote attackers to execute arbitrary code.
2
How do I fix CVE-2013-7455?
To fix CVE-2013-7455, update Little CMS to version 2.6 or later.
3
Which software versions are affected by CVE-2013-7455?
CVE-2013-7455 affects Little CMS versions 2.0 through 2.5.
4
What type of vulnerability is CVE-2013-7455?
CVE-2013-7455 is a double free vulnerability found in the DefaultICCintents function.
5
Can CVE-2013-7455 be exploited remotely?
Yes, CVE-2013-7455 can be exploited remotely via a malformed ICC profile.