littlecms records
15 published records for vendor littlecms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 4
- With a fix record
- 80%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer3
- CWE-787 Out-of-bounds Write3
- CWE-190 Integer Overflow or Wraparound2
- CWE-189 Numeric Errors1
- CWE-20 Improper Input Validation1
- CWE-401 Missing Release of Memory after Effective Lifetime1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
15 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
41Plan | CVE-2013-7455No exploit | Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers tlittlecms · little cms color engine | Critical9.8 | — | 6.2% | May 7, 2016 |
41Plan | CVE-2008-5316No exploit | Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to halittlecms · lcms · CWE-119 | Critical10.0 | — | 2.7% | Dec 3, 2008 |
41Plan | CVE-2008-5317No exploit | Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers littlecms · lcms · CWE-189 | Critical10.0 | — | 2.1% | Dec 3, 2008 |
39Monitor | CVE-2007-2741No exploit | Stack-based buffer overflow in Little CMS (lcms) before 1.15 allows remote attackers to execute arbitrary code or cause a denial of service littlecms · lcms · CWE-119 | Critical9.3 | — | 7.9% | May 17, 2007 |
39Monitor | CVE-2009-0733No exploit | Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefolittlecms · little cms · CWE-787 | Critical9.3 | — | 5.5% | Mar 23, 2009 |
39Monitor | CVE-2009-0723No exploit | Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow contextgimp · gimp · CWE-190 | Critical9.3 | — | 5.0% | Mar 23, 2009 |
31Monitor | CVE-2018-11556No exploit | tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a craftelittlecms · little cms · CWE-787 | High7.8 | — | 1.0% | May 30, 2018 |
31Monitor | CVE-2018-11555No exploit | tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file.littlecms · little cms · CWE-787 | High7.8 | — | 1.0% | May 30, 2018 |
30Monitor | CVE-2026-41254No exploit | Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplicalittlecms · little cms · CWE-696 | High7.5 | — | 0.3% | Apr 18, 2026 |
29Monitor | CVE-2016-10165No exploit | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a deniallittlecms · little cms color engine · CWE-125 | High7.1 | — | 2.7% | Feb 3, 2017 |
23Monitor | CVE-2018-16435No exploit | Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heaplittlecms · little cms color engine · CWE-190 | Medium5.5 | — | 1.7% | Sep 3, 2018 |
21Monitor | CVE-2013-4160No exploit | Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL littlecms · little cms color engine | Medium5.0 | — | 2.8% | Jan 21, 2014 |
18Monitor | CVE-2009-0793No exploit | cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of servlittlecms · lcms · CWE-20 | Medium4.3 | — | 4.8% | Apr 9, 2009 |
18Monitor | CVE-2013-4276No exploit | Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of serviclittlecms · little cms color engine · CWE-119 | Medium4.3 | — | 4.0% | Sep 28, 2013 |
18Monitor | CVE-2009-0581No exploit | Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attlittlecms · little cms · CWE-401 | Medium4.3 | — | 2.5% | Mar 23, 2009 |
- CVE-2013-745541Plan
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers t
CriticalCVSS 9.8No exploitEPSS 6%littlecms · little cms color engineMay 7, 2016
- CVE-2008-531641Plan
Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to ha
CriticalCVSS 10.0No exploitEPSS 2%littlecms · lcmsDec 3, 2008
- CVE-2008-531741Plan
Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers
CriticalCVSS 10.0No exploitEPSS 2%littlecms · lcmsDec 3, 2008
- CVE-2007-274139Monitor
Stack-based buffer overflow in Little CMS (lcms) before 1.15 allows remote attackers to execute arbitrary code or cause a denial of service
CriticalCVSS 9.3No exploitEPSS 7%littlecms · lcmsMay 17, 2007
- CVE-2009-073339Monitor
Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefo
CriticalCVSS 9.3No exploitEPSS 5%littlecms · little cmsMar 23, 2009
- CVE-2009-072339Monitor
Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context
CriticalCVSS 9.3No exploitEPSS 5%gimp · gimpMar 23, 2009
- CVE-2018-1155631Monitor
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafte
HighCVSS 7.8No exploitEPSS 1%littlecms · little cmsMay 30, 2018
- CVE-2018-1155531Monitor
tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file.
HighCVSS 7.8No exploitEPSS 1%littlecms · little cmsMay 30, 2018
- CVE-2026-4125430Monitor
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplica
HighCVSS 7.5No exploitEPSS 0%littlecms · little cmsApr 18, 2026
- CVE-2016-1016529Monitor
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial
HighCVSS 7.1No exploitEPSS 2%littlecms · little cms color engineFeb 3, 2017
- CVE-2018-1643523Monitor
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap
MediumCVSS 5.5No exploitEPSS 1%littlecms · little cms color engineSep 3, 2018
- CVE-2013-416021Monitor
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL
MediumCVSS 5.0No exploitEPSS 2%littlecms · little cms color engineJan 21, 2014
- CVE-2009-079318Monitor
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of serv
MediumCVSS 4.3No exploitEPSS 4%littlecms · lcmsApr 9, 2009
- CVE-2013-427618Monitor
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of servic
MediumCVSS 4.3No exploitEPSS 4%littlecms · little cms color engineSep 28, 2013
- CVE-2009-058118Monitor
Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent att
MediumCVSS 4.3No exploitEPSS 2%littlecms · little cmsMar 23, 2009