CVE-2013-7455
9.8
CRITICAL · CVSS 3.0 · EPSS 6.2% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 6.23% — more likely to be exploited than 93% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2016-05-07 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| littlecms | little cms color engine |
References
- http://www.kb.cert.org/vuls/id/369800
- http://www.ubuntu.com/usn/USN-2961-1
- https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
- https://penteston.com/OSVDB-105462
- http://www.kb.cert.org/vuls/id/369800
- http://www.ubuntu.com/usn/USN-2961-1
- https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
- https://penteston.com/OSVDB-105462
→ the Explorer · watch your stack · NVD