CVE-2009-0793
Fixed in a distro release EPSS 5%
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
Products: littlecms lcms, sun openjdk
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | openjdk-6 | 6b11-9.1+lenny2 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk | 1:1.6.0.0-0.30.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-debuginfo | 1:1.6.0.0-0.30.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-demo | 1:1.6.0.0-0.30.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-devel | 1:1.6.0.0-0.30.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-javadoc | 1:1.6.0.0-0.30.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-src | 1:1.6.0.0-0.30.b09.el5 |
| openSUSE Tumbleweed | lcms | 1.19-19.8 |