iccDEV Color Management Software Can Crash or Be Hacked

Summary

Some versions of iccDEV software have a flaw that can cause it to crash or be exploited by hackers. This flaw is fixed in version 2.3.1.5. To stay safe, upgrade to the latest version of iccDEV.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurvesFromXml() causing heap memory corrupt...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurvesFromXml() causing heap memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 7.8

Vulnerability type

CWE-122 Heap-based Buffer Overflow

CWE-787 Out-of-bounds Write