iccDEV libraries and tools crash or corrupt data

Summary

Prior to version 2.3.1.5, using iccDEV libraries and tools could cause a software crash or corrupt data. This affects users who rely on iccDEV for color management. Update to version 2.3.1.5 or later to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow write in CIccXform3DLut::Apply() corrupting stack mem...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow write in CIccXform3DLut::Apply() corrupting stack memory or crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 7.8

Vulnerability type

CWE-120 Classic Buffer Overflow

CWE-121 Stack-based Buffer Overflow

CWE-787 Out-of-bounds Write