CVE-2009-0793: littlecms lcms Improper Input Validation

EPSS trend

Probability

4.83%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.83% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

References

26 links

www.mandriva.com/security/advisories?name=MDVSA-2009:137Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/34635Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/34632Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2009-May/msg00233.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/34623Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/USN-1043-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/34675Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/0964VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/35048Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2009-April/msg00204.htmlVendor AdvisoryX Refsource FEDORA

Show all 26 references

rhn.redhat.com/errata/RHSA-2009-0377.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/34782Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2011/0087VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11340VDB EntrySignatureX Refsource OVAL
www.mandriva.com/security/advisories?name=MDVSA-2009:162Vendor AdvisoryX Refsource MANDRIVA
www.redhat.com/archives/fedora-package-announce/2009-April/msg00203.htmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/bid/34411VDB EntryX Refsource BID
bugzilla.redhat.com/show_bug.cgi?id=492353X Refsource CONFIRM
www.securityfocus.com/bid/34420VDB EntryX Refsource BID
www.debian.org/security/2009/dsa-1769Vendor AdvisoryX Refsource DEBIAN
www.vupen.com/english/advisories/2009/0963VDB EntryX Refsource VUPENVendor Advisory
www.redhat.com/archives/fedora-package-announce/2009-May/msg00285.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/34634Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:121Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/42870Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200904-19.xmlVendor AdvisoryX Refsource GENTOO

Related vulnerabilities

RoutineCVE-2009-1896sun · openjdk17y agosun openjdkThe Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.CVSS10.0CriticalEPSS3.03%RoutineCVE-2009-0794sun · openjdk17y agosun openjdkInteger overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.CVSS5.0MediumEPSS3.02%PrioritiseCVE-2009-0733gimp +3 more17y agogimp gimpMultiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.CVSS9.3CriticalEPSS5.53%PrioritiseCVE-2009-0723gimp +3 more17y agogimp gimpMultiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.CVSS9.3CriticalEPSS5.03%RoutineCVE-2008-5317littlecms · lcms +1 more17y agolittlecms lcmsInteger signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.CVSS10.0CriticalEPSS2.16%PrioritiseCVE-2008-5316littlecms · lcms +1 more17y agolittlecms lcmsBuffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different vulnerability than CVE-2007-2741.CVSS10.0CriticalEPSS2.78%

All vulnerabilities inlcms openjdk

CVE-2009-0793: littlecms lcms Improper Input Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References