iccDEV Heap-Based Buffer Overflow Vulnerability in CIccCalculatorFunc

A heap-based buffer overflow vulnerability has been identified in iccDEV versions prior to 2.3.1.5. This issue, located in the CIccCalculatorFunc::InitSelectOp() function, is triggered by local user interaction, leading to memory corruption and crashes. The vulnerability has been addressed in version 2.3.1.5.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and application crashes.

Reproduction

The vulnerability can be reproduced by using a crafted ICC file that exploits the buffer overflow in the CIccCalculatorFunc::InitSelectOp() function. This can be done by downloading the ICC file associated with this vulnerability and using the 'iccRoundTrip' tool to process it. The AddressSanitizer will report the heap-buffer-overflow error, indicating that the vulnerability has been successfully exploited.

Remediation

Users can upgrade to iccDEV version 2.3.1.5 or later to address this vulnerability.