CVE-2009-0723

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-03-23 · updated 2026-06-16
Weakness: CWE-190

Description

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

Affected products

GIMP: before 2.9.2 — fixed in 2.9.2
littlecms little cms color engine: through 1.17
Mozilla Firefox: 3.1-beta1
Sun Openjdk: through 7

How to fix

Upgrade to a fixed version: GIMP 2.9.2. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://scary.beasts.org/security/CESA-2009-003.html
http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html
http://secunia.com/advisories/34367
http://secunia.com/advisories/34382
http://secunia.com/advisories/34400
http://secunia.com/advisories/34408
http://secunia.com/advisories/34418
http://secunia.com/advisories/34442
http://secunia.com/advisories/34450
http://secunia.com/advisories/34454
http://secunia.com/advisories/34463

Get alerted when CVE-2009-0723 or the next vulnerability affects your stack