iccDEV Color Management Tools Crash on Certain Input

Summary

Using iccDEV tools with certain color management profiles can cause the program to crash. This is a serious issue because it can make it difficult or impossible to work with color profiles. Update to version 2.3.1.5 or later to fix the problem.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 7.8

Vulnerability type

CWE-416 Use After Free

CWE-672

CWE-825