What’s Vulnerable › Vulnerabilities

CVE-2013-7455

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-05-07 · updated 2026-06-17

Description

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

Affected products

• littlecms Little Cms Color Engine: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5

References

• http://www.kb.cert.org/vuls/id/369800
• http://www.ubuntu.com/usn/USN-2961-1
• https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
• https://penteston.com/OSVDB-105462
• http://www.kb.cert.org/vuls/id/369800
• http://www.ubuntu.com/usn/USN-2961-1
• https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
• https://penteston.com/OSVDB-105462

Get alerted when CVE-2013-7455 or the next vulnerability affects your stack