International Color Consortium iccDEV Out-of-Bounds Read and Integer Underflow Vulnerability

A vulnerability allowing out-of-bounds read and integer underflow has been identified in the iccDEV library, which is used for managing ICC color profiles. This issue is present in versions prior to 2.3.1.1 and arises in the 'SequenceNeedTempReset' function of the 'CIccCalculatorFunc' class. The vulnerability can be exploited by processing specially crafted ICC profiles, leading to potential memory access violations.

Impact

Exploitation of this vulnerability causes an out-of-bounds read, which can lead to memory corruption or disclosure of sensitive information. Additionally, the integer underflow can be exploited to manipulate memory operations, potentially causing further memory corruption.

Remediation

Users can upgrade to version 2.3.1.2, where this vulnerability has been fixed.