iccDEV: Memory Disclosure or Crash with Malformed TIFF Image

Summary

Malicious TIFF images can reveal sensitive information or cause iccDEV to crash. This issue affects all versions of iccDEV prior to 2.3.1.5. Update to version 2.3.1.5 or later to fix the problem.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
color	iccdev	<= 2.3.1.5	–

Original title

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CTiffImg::ReadLine() when iccApplyProfiles proce...

Original description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CTiffImg::ReadLine() when iccApplyProfiles processes a crafted TIFF image, causing memory disclosure or crash. This vulnerability is fixed in 2.3.1.5.

nvd CVSS3.1 6.1

Vulnerability type

CWE-125 Out-of-bounds Read

CWE-787 Out-of-bounds Write