iccDEV vulnerabilities

The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have undefined behavior in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccProfileXml::ParseBasic() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccTagXmlFloatNum<>::ParseXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have undefined behavior in the icSigCalcOp() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagNamedColor2::SetSize() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccMpeCalculator::Read() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have a null pointer dereference and undefined behavior vulnerability in CIccXmlArrayType(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.

The iccDEV library versions 2.3.1.1 and below have an integer overflow vulnerability in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary code execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.

The iccDEV library before version 2.3.1.2 contains a heap-based buffer overflow vulnerability in the SIccCalcOp::Describe() function in IccProfLib/IccMpeCalc.cpp. This affects users who process ICC color profiles.

iccDEV before version 2.3.1.2 has a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch.

iccDEV versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagCurve::CIccTagCurve()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLutAtoB::Validate()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

The iccDEV library before version 2.3.1.2 has undefined behavior in the `CIccTagLut16::Read()` function. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch, no known workarounds.

The iccDEV library before version 2.3.1.2 has undefined behavior in the `CIccTagSpectralViewingConditions()` function. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch, no known workarounds.

The iccDEV library before version 2.3.1.2 has a Type Confusion vulnerability in the `icStatusCMM::CIccEvalCompare::EvaluateProfile()` function. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch, no known workarounds.

The iccDEV library before version 2.3.1.2 has a heap-buffer-overflow in the `CIccXmlArrayType::ParseText()` function. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch, no known workarounds.

The iccDEV library before version 2.3.1.2 has an Undefined Behavior runtime error. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch, no known workarounds.

The iccDEV library before version 2.3.1.2 is vulnerable to heap-buffer-overflow in `CIccLocalizedUnicode::GetText()`. This issue has been patched in version 2.3.1.2.

The iccDEV library before version 2.3.1.2 is vulnerable to heap-buffer-overflow in `IccTagXml()`. This issue has been patched in version 2.3.1.2.

The iccDEV library in versions 2.3.1 and below has undefined behavior in the CIccCLUT::Init function, which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.

The iccDEV library in versions 2.3.1.1 and below contains Use After Free, Heap-based Buffer Overflow, Integer Overflow or Wraparound, and Out-of-bounds Write vulnerabilities in the CIccSparseMatrix::CIccSparseMatrix function. This issue is fixed in version 2.3.1.2.

The iccDEV library in versions 2.3.1.1 and earlier is prone to Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.

The iccDEV library in versions 2.3.1 and below contains overflows and underflows in the CIccXmlArrayType::ParseTextCountNum() function. This vulnerability affects users processing ICC color profiles. The issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop in the CalcProfileID function in IccProfile.cpp. This issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

iccDEV before version 2.3.2.1 has a size_t underflow vulnerability in the `CIccEmbedIO::Read8()` function. The issue occurs when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads, potentially leading to incorrect behavior.