iccDEV NULL Pointer Dereference Vulnerability in Unknown Tag Parser

A NULL pointer dereference vulnerability has been identified in the iccDEV library, which is used for managing ICC color profiles. This issue exists in versions prior to 2.3.1.2 and arises in the unknown tag parser, where the parser attempts to process a node that can be NULL, leading to a crash. The vulnerability has been patched in version 2.3.1.2.

Impact

Exploitation of this vulnerability causes a segmentation fault due to a NULL pointer dereference, which can lead to a crash of the application using the iccDEV library.

Reproduction

The vulnerability can be reproduced by parsing an ICC profile XML file that triggers the unknown tag parser to dereference a NULL node. This can be done using the 'iccFromXml' tool included in the iccDEV distribution, with a crafted XML file that simulates the conditions leading to the NULL dereference.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later to address this vulnerability.