iccDEV Heap-Based Buffer Overflow Vulnerability in SIccCalcOp::Describe()

A heap-based buffer overflow vulnerability has been identified in the iccDEV library, specifically in the SIccCalcOp::Describe() function within the IccProfLib/IccMpeCalc.cpp file. This vulnerability affects versions prior to 2.3.1.2 and can be exploited by users processing International Color Consortium (ICC) color profiles.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, which can commonly result in arbitrary code execution or a crash of the application.

Reproduction

The vulnerability can be reproduced by using the 'iccToXml' tool included in the iccDEV library. This tool can be used to process an ICC file that triggers the buffer overflow. The AddressSanitizer, a memory error detection tool, can be used to identify the heap-buffer-overflow error while the 'iccToXml' tool is running.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later to address this vulnerability.