RHSA-2009:0339: Moderate: lcms security update
Little Color Management System (LittleCMS, or simply "lcms") is asmall-footprint, speed-optimized open source color management engine.Multiple integer overflow flaws which could lead to heap-based bufferoverflows, as well as multiple insufficient input validation flaws, werefound in LittleCMS. An attacker could use these flaws to create aspecially-crafted image file which could cause an application usingLittleCMS to crash, or, possibly, execute arbitrary code when opened by avictim. (CVE-2009-0723, CVE-2009-0733)A memory leak flaw was found in LittleCMS. An application using LittleCMScould use excessive amount of memory, and possibly crash after using allavailable memory, if used to open specially-crafted images. (CVE-2009-0581)Red Hat would like to thank Chris Evans from the Google Security Team forreporting these issues.All users of LittleCMS should install these updated packages, which upgradeLittleCMS to version 1.18. All running applications using the lcms librarymust be restarted for the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:0339?
The severity of RHSA-2009:0339 is considered important due to potential exploitation leading to security vulnerabilities.
How do I fix RHSA-2009:0339?
To fix RHSA-2009:0339, you should upgrade to the specified version 1.18-0.1.beta1.el5_3.2 of the affected packages.
What software is affected by RHSA-2009:0339?
RHSA-2009:0339 affects packages including lcms, lcms-devel, and python-lcms on applicable Red Hat systems.
What vulnerabilities are addressed in RHSA-2009:0339?
RHSA-2009:0339 addresses multiple integer overflow flaws and insufficient input validation issues in LittleCMS.
Is there a risk of exploitation with RHSA-2009:0339?
Yes, there is a risk of remote code execution and denial of service if the vulnerabilities in RHSA-2009:0339 are exploited.