iccDEV Type Confusion Vulnerability in CIccProfileXml::ParseBasic()

A type confusion vulnerability has been identified in the iccDEV library, specifically in the 'CIccProfileXml::ParseBasic()' function within 'IccXML/IccLibXML/IccProfileXml.cpp'. This vulnerability affects versions prior to 2.3.1.2 and can lead to an access violation by dereferencing a null pointer, which may be exploited by users processing ICC color profiles. The issue requires user interaction and has a moderate severity rating.

Impact

Exploitation of this vulnerability causes a type confusion error, leading to an access violation by dereferencing a null pointer. This undefined behavior can potentially be exploited to manipulate program execution or cause a crash.

Reproduction

The vulnerability can be reproduced by using the 'iccFromXml' command with a crafted XML file that includes a profile version and color space data. The 'ParseBasic' function will attempt to read the profile, but due to insufficient null pointer checks, it will dereference a null pointer, causing a runtime error.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later, where this vulnerability has been patched.