iccDEV Color Management Software Can Crash or Be Hacked

Summary

A software tool for working with color profiles has a bug that can cause it to crash or be taken over by an attacker. This tool is used by some businesses for color management in their graphics and printing operations. It's recommended to update to the latest version to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruptio...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 7.8

Vulnerability type

CWE-120 Classic Buffer Overflow

CWE-121 Stack-based Buffer Overflow

CWE-787 Out-of-bounds Write