iccDEV Stack Buffer Overflow Vulnerability in icFixXml() Function

A stack buffer overflow vulnerability has been identified in the iccDEV color management library, prior to version 2.3.1.5. The issue arises in the icFixXml() function, where improper use of strcpy creates a buffer overflow, leading to stack memory corruption or application crashes. This vulnerability requires user interaction to exploit.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using the 'iccToXml' command-line tool included in the iccDEV package. After downloading a crafted ICC file that triggers the buffer overflow, this file can be processed with 'iccToXml', which will result in a stack buffer overflow error.

Remediation

Users can upgrade to iccDEV version 2.3.1.5 or later, where this vulnerability has been fixed. The latest version is available on the GitHub Releases page.