CVE-2013-7455

Critical

Published: 07/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data theft.

Recommendation

It is recommended to update liblcms2 to version 2.6 or later to mitigate this vulnerability.

Original NVD description (English source)

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.