iccDEV Color Management Libraries Exposed to Memory Corruption

Summary

If you use iccDEV to work with color management profiles, a security update is available to fix a memory corruption risk that could cause crashes or other issues. Update to version 2.3.1.5 or later to protect your system.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memo...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 7.8

Vulnerability type

CWE-120 Classic Buffer Overflow

CWE-122 Heap-based Buffer Overflow

CWE-787 Out-of-bounds Write