Vulnerability Details : CVE-2009-0793
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
Vulnerability category: Memory CorruptionInput validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2009-0793
Probability of exploitation activity in the next 30 days: 5.27%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-0793
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2009-0793
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2009-0793
-
Red Hat 2009-04-09Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-0793 The Red Hat Security Response Team has rated this issue as having low security impact, a future lcms packages update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:121
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:162
- http://www.debian.org/security/2009/dsa-1769
-
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00233.html
- https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00204.html
-
http://www.securityfocus.com/bid/34420
-
http://www.vupen.com/english/advisories/2009/0963
Vendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=492353
-
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00285.html
-
http://www.vupen.com/english/advisories/2011/0087
- https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00203.html
- http://security.gentoo.org/glsa/glsa-200904-19.xml
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11340
-
http://www.securityfocus.com/bid/34411
- https://rhn.redhat.com/errata/RHSA-2009-0377.html
-
http://www.ubuntu.com/usn/USN-1043-1
-
http://www.vupen.com/english/advisories/2009/0964
Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:137
- cpe:2.3:a:sun:openjdk:6:*:*:*:*:*:*:*
- cpe:2.3:a:littlecms:lcms:1.18:*:*:*:*:*:*:*