GCVE - cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Littlecms (`de2842e2-f326-5c13-90f6-56cba8b115a4`)
Product	Little Cms (`c07ccb10-bc42-5cc5-9b76-8397efb2676f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/mm2/little-cms`	purl2cpe	2026-06-01 10:16:16.864697

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-41254`	vulnerable	2026-06-08 08:03:15.128543	Details available MEDIUM (4) Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. Published: 2026-04-18T06:43:13.741Z Updated: 2026-05-07T17:33:56.924Z Open on db.gcve.eu Reference links https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc https://www.openwall.com/lists/oss-security/2026/04/17/16 https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0733`	vulnerable	2026-06-08 04:51:11.006625	Details available Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions. Published: 2009-03-23T14:00:00.000Z Updated: 2024-08-07T04:48:51.638Z Open on db.gcve.eu Reference links https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html https://exchange.xforce.ibmcloud.com/vulnerabilities/49330 http://www.mandriva.com/security/advisories?name=MDVSA-2009:137 http://secunia.com/advisories/34632 http://secunia.com/advisories/34450	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0723`	vulnerable	2026-06-08 04:51:10.993779	Details available Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Published: 2009-03-23T14:00:00.000Z Updated: 2024-08-07T04:48:51.612Z Open on db.gcve.eu Reference links https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:137 http://secunia.com/advisories/34632 http://secunia.com/advisories/34450 http://www.securitytracker.com/id?1021869	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0581`	vulnerable	2026-06-08 04:51:10.153866	Details available Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file. Published: 2009-03-23T14:00:00.000Z Updated: 2024-08-07T04:40:04.074Z Open on db.gcve.eu Reference links https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:137 http://secunia.com/advisories/34632 http://secunia.com/advisories/34450 https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.