Login Request a demo
Unscored severity · published Jan 21, 2014
CVE-2013-4160
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
Little Cms Color Engine · Littlecms
through 2.4; 1.07; 1.08; 1.09; 1.10; 1.11; +12 more · source: NVD
Affected product
LC
Little Cms Color Engine
Littlecms
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4160
mail.openjdk.java.net
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-July/023895.html
openwall.com
http://openwall.com/lists/oss-security/2013/07/18/7
openwall.com
http://openwall.com/lists/oss-security/2013/07/22/1
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1911-1
bugzilla.novell.com
https://bugzilla.novell.com/show_bug.cgi?id=826097#c9
github.com
https://github.com/mm2/Little-CMS/commit/91c2db7f2559be504211b283bc3a2c631d6f06d9
More from Little Cms Color Engine
9.8
CVE-2013-7455
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a…
7.5
CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication
7.1
CVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted…
5.5
CVE-2018-16435
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData…
4.0
CVE-2026-42798
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c