iccDEV Stack Buffer Overflow Vulnerability in CIccTagNum::GetValues()

A stack buffer overflow vulnerability has been identified in iccDEV versions prior to 2.3.1.5. This issue occurs in the CIccTagNum<>::GetValues() function, leading to stack memory corruption or crashes. The vulnerability has been patched in version 2.3.1.5.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using a crafted ICC file that exploits the buffer overflow in the CIccTagNum::GetValues() method. This can be done by using the 'iccApplyNamedCmm' tool to apply a named color transformation, which triggers the vulnerable function and causes the stack overflow.

Remediation

Users can upgrade to iccDEV version 2.3.1.5 or later to address this vulnerability.