iccDEV Heap Buffer Overflow Vulnerability in ICC Profile Processing

A heap buffer overflow vulnerability has been identified in the iccDEV library, specifically in versions prior to 2.3.1.2. This vulnerability arises in the 'CIccTagLut8::Validate()' function, where improper validation of ICC color profiles can be exploited. The issue has been addressed in version 2.3.1.2, but no workarounds are available.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

The vulnerability can be reproduced by using the iccDEV library to process ICC color profiles that include certain LUT (Look-Up Table) tags. The 'CIccTagLut8::Validate()' function will not properly validate the channel counts of the LUT, allowing for a heap buffer overflow to occur.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later to address this vulnerability.