Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:3545-1

Опубликовано: 29 окт. 2018
Источник: suse-cvrf

Описание

Security update for lcms2

This update for lcms2 fixes the following security issues:

  • CVE-2016-10165: The Type_MLU_Read function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read (bsc#1021364).
  • CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)
  • Ensure that LUT stages match channel count (bsc#1026649).
  • sanitize input and output channels on MPE profiles (bsc#1026650).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
lcms2-2.7-9.7.1
liblcms2-2-2.7-9.7.1
liblcms2-2-32bit-2.7-9.7.1
SUSE Linux Enterprise Server 12 SP3
lcms2-2.7-9.7.1
liblcms2-2-2.7-9.7.1
liblcms2-2-32bit-2.7-9.7.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
lcms2-2.7-9.7.1
liblcms2-2-2.7-9.7.1
liblcms2-2-32bit-2.7-9.7.1
SUSE Linux Enterprise Software Development Kit 12 SP3
liblcms2-devel-2.7-9.7.1

Ссылки

Описание

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:lcms2-2.7-9.7.1
SUSE Linux Enterprise Desktop 12 SP3:liblcms2-2-2.7-9.7.1
SUSE Linux Enterprise Desktop 12 SP3:liblcms2-2-32bit-2.7-9.7.1
SUSE Linux Enterprise Server 12 SP3:lcms2-2.7-9.7.1
Ссылки

Описание

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:lcms2-2.7-9.7.1
SUSE Linux Enterprise Desktop 12 SP3:liblcms2-2-2.7-9.7.1
SUSE Linux Enterprise Desktop 12 SP3:liblcms2-2-32bit-2.7-9.7.1
SUSE Linux Enterprise Server 12 SP3:lcms2-2.7-9.7.1
Ссылки
Уязвимость SUSE-SU-2018:3545-1