« Volver al listado

CVE-2013-7455

Estado: ModificadaCrítica (9.8)—

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Littlecms — Little CMS Color Engine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-7455",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-05-07T10:59:00.140",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/369800",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2961-1",
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db",
      "source": "cret@cert.org"
    },
    {
      "url": "https://penteston.com/OSVDB-105462",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/369800",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2961-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://penteston.com/OSVDB-105462",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de liberación doble de memoria en la función DefaultICCintents en cmscnvrt.c en liblcms2 en Little CMS 2.x en versiones anteriores a 2.6 permite a atacantes remotos ejecutar código arbitrario a través de un perfil ICC mal formado que desencadena un error en el manejador de intent por defecto."
    }
  ],
  "lastModified": "2026-06-17T00:01:59.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A95BCF6-024D-437A-B63C-5C164344D3F0"
            },
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "196E282E-A45A-4E3A-B66D-CC4ED40F2610"
            },
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEA931F1-E407-471D-97EA-758CE2B535F7"
            },
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97D2A8BE-7090-4473-9FAA-DBA6E3C5C241"
            },
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "699D6741-8013-4494-B430-2C420C97286E"
            },
            {
              "criteria": "cpe:2.3:a:littlecms:little_cms_color_engine:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F24B6C3-39FB-4900-A6DC-B3086B91926E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/415.html\">CWE-415: Double Free</a>",
  "sourceIdentifier": "cret@cert.org"
}