CVE-2008-5317

lcms: unsigned -> signed integer cast issue in cmsAllocGamma

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.

Error de presencia de signo en entero en la función cmsAllocGamma en src/cmsgamma.c en Little cms color engine (alias lcms) en versiones anteriores a 1.17 que permite a los atacantes tener un impacto desconocido a través de un archivo que contiene un cierto número de valores de entrada, que son interpretados inapropiadamente, permitiendo una asignación de memoria insuficiente.

*Credits: N/A

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-12-03 CVE Reserved
2008-12-03 CVE Published
2023-03-07 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-189: Numeric Errors

CAPEC

References (12)

URL	Tag	Source
http://secunia.com/advisories/33066	Third Party Advisory
http://secunia.com/advisories/33219	Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/11/28/3	Mailing List
http://www.securityfocus.com/bid/32708	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/47120	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10685	Signature

URL	Date	SRC

URL	Date	SRC
http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsgamma.c?view=diff&r1=1.16&r2=1.17	2018-10-03

URL	Date	SRC
http://www.debian.org/security/2008/dsa-1684	2018-10-03
http://www.redhat.com/support/errata/RHSA-2009-0011.html	2018-10-03
https://usn.ubuntu.com/693-1	2018-10-03
https://access.redhat.com/security/cve/CVE-2008-5317	2009-01-07
https://bugzilla.redhat.com/show_bug.cgi?id=473463	2009-01-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				<= 1.16 Search vendor "Littlecms" for product "Lcms" and version " <= 1.16"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.07 Search vendor "Littlecms" for product "Lcms" and version "1.07"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.08 Search vendor "Littlecms" for product "Lcms" and version "1.08"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.09 Search vendor "Littlecms" for product "Lcms" and version "1.09"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.10 Search vendor "Littlecms" for product "Lcms" and version "1.10"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.11 Search vendor "Littlecms" for product "Lcms" and version "1.11"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.12 Search vendor "Littlecms" for product "Lcms" and version "1.12"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.13 Search vendor "Littlecms" for product "Lcms" and version "1.13"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.14 Search vendor "Littlecms" for product "Lcms" and version "1.14"		-		Affected
Littlecms Search vendor "Littlecms"		Lcms Search vendor "Littlecms" for product "Lcms"				1.15 Search vendor "Littlecms" for product "Lcms" and version "1.15"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				<= 1.16 Search vendor "Littlecms" for product "Little Cms Color Engine" and version " <= 1.16"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.07 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.07"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.08 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.08"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.09 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.09"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.10 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.10"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.11 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.11"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.12 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.12"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.13 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.13"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.14 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.14"		-		Affected
Littlecms Search vendor "Littlecms"		Little Cms Color Engine Search vendor "Littlecms" for product "Little Cms Color Engine"				1.15 Search vendor "Littlecms" for product "Little Cms Color Engine" and version "1.15"		-		Affected