Denial of Service Vulnerability in Little CMS Used by OpenJDK

CVE-2013-4160

What is CVE-2013-4160?

A vulnerability in Little CMS (lcms2) versions prior to 2.5, utilized in OpenJDK 7 and possibly other products, allows remote attackers to exploit certain functions, leading to a denial of service. Specifically, functions such as cmsStageAllocLabV2ToV4curves, cmsPipelineDup, cmsAllocProfileSequenceDescription, CurvesAlloc, and cmsnamed may trigger a NULL pointer dereference, resulting in application crashes. This issue underscores the importance of keeping software updated to mitigate potential attacks.

References