Vulnerability Details : CVE-2018-11556
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”
Products affected by CVE-2018-11556
- cpe:2.3:a:littlecms:little_cms:2.9:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-11556
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-11556
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2018-11556
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-11556
-
https://github.com/mm2/Little-CMS/issues/167
Some bugs in CMS · Issue #167 · mm2/Little-CMS · GitHubThird Party Advisory
-
https://github.com/xiaoqx/pocs/tree/master/cms
pocs/cms at master · xiaoqx/pocs · GitHubThird Party Advisory
Jump to