CVE catalog

CVE-2013-7455

lcms2: CVE-2013-7455

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
6.23% · Oct 25, 2026

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlcms2sid2.19.1-1fixed
Debianlcms2forky2.19.1-1fixed
Debianlcms2trixie2.16-2+deb13u2fixed
Debianlcms2trixie-security2.16-2+deb13u2fixed
Debianlcms2bookworm2.14-2+deb12u1fixed
Debianlcms2bookworm-security2.14-2+deb12u1fixed
Ubuntulcms214.042.5-0ubuntu1vulnerable
Ubuntulcms214.042.5-0ubuntu2vulnerable
Ubuntulcms214.042.5-0ubuntu3vulnerable
Ubuntulcms214.042.5-0ubuntu4vulnerable
Ubuntulcms214.042.5-0ubuntu4.1fixed
Ubuntulcms214.042.5-0ubuntu1vulnerable
Ubuntulcms214.042.5-0ubuntu2vulnerable
Ubuntulcms214.042.5-0ubuntu3vulnerable
Ubuntulcms214.042.5-0ubuntu4vulnerable
Ubuntulcms214.042.5-0ubuntu4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlcms2sourcesid2.6-1not yet assignedNot reportedNot reported
Debianlcms2sourceforky2.6-1not yet assignedNot reportedNot reported
Debianlcms2sourcetrixie2.6-1not yet assignedNot reportedNot reported
Debianlcms2sourcebookworm2.6-1not yet assignedNot reportedNot reported
Ubuntulcms2deb14.042.5-0ubuntu4.1Not reportedUBUNTU-CVE-2013-7455Not reported
Ubuntulcms2deb14.042.5-0ubuntu4.1Not reportedUSN-2961-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [liblcms2-2]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.14-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

  • [liblcms2-dev]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.14-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

  • [liblcms2-utils]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.14-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

    • 2.14-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · bookworm; dsa · lcms2 · debian · 12

[Debian 13 (Trixie)]

  • [liblcms2-2]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.16-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

  • [liblcms2-dev]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.16-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

  • [liblcms2-utils]Unknown

    Source package: [lcms2]

    Details (4)

    • 2.16-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

    • 2.16-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 2.6-1

      dsa · lcms2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]