iccDEV NULL Pointer Dereference Vulnerability in XML Profile Parsing

A NULL pointer dereference vulnerability has been identified in the iccDEV library, specifically in versions prior to 2.3.1.2. This issue arises in the XML parser when the 'RenderingIntent' element is processed, leading to a runtime error. The vulnerability requires user interaction to be exploited, as it involves parsing XML files that may be crafted to trigger the issue.

Impact

Exploitation of this vulnerability causes a runtime error due to undefined behavior, specifically a member access within a null pointer. This disruption can lead to application crashes or instability.

Reproduction

The vulnerability can be reproduced by using the 'iccFromXml' command with an XML file that includes an 'IccProfile' element. The crafted XML should omit the 'RenderingIntent' value, which is expected to be present. This absence triggers the NULL pointer dereference when the XML is parsed, simulating the vulnerability.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later, where this vulnerability has been patched. Instructions for updating can be found in the iccDEV repository on GitHub.