iccDEV Library Crashes and Leaks Memory When Converting Color Profiles

Summary

Using an outdated version of the iccDEV library can cause a program to crash and leak sensitive memory contents when converting color profiles. This affects programs that use the library for color management tasks. Update to version 2.3.1.5 or later to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() causing crash and...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() causing crash and potentially leaking memory contents. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 6.1

Vulnerability type

CWE-122 Heap-based Buffer Overflow

CWE-125 Out-of-bounds Read

CWE-129