SB2018090509 - Debian update for lcms2
Published: September 5, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Integer overflow (CVE-ID: CVE-2018-16435)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the AllocateDataSet function in cmscgats.c when handling malicious input. A remote unauthenticated attacker can supply a specially crafted file in the second argument to cmsIT8LoadFromFile, trigger heap-based buffer overflow in the SetData function and cause the service to crash or execute arbitrary code with elevated prvileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.