CVE-2013-4276
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
Exploit likelihood
What each source reports
NVD Score used
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
- Record
CVE-2013-4276- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
- Record
CVE-2013-4276- Updated
- 2026-11-02
EUVDEUVD-2013-4175 No score
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
- Record
EUVD-2013-4175- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g29-grmj-m4x3 No score
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...
Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.
- Record
GHSA-7g29-grmj-m4x3- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVMGASA-2013-0260 No score
Updated lcms package fixes security vulnerability
Three buffer overflows in Little CMS version 1.19 that could possibly be exploited through user input (CVE-2013-4276).
- Record
MGASA-2013-0260- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10340-1 No score
lcms-1.19-19.8 on GA media
These are all security issues fixed in the lcms-1.19-19.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10340-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4276 is a medium vulnerability (CVSS 4.3) in Littlecms Little Cms Color Engine, published August 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.04%, the 90th percentile. Fixed in lcms 1.19-6.1.mga2.
References
usn.ubuntu.com/3770-2
bugzilla.redhat.com/show_bug.cgi?id=992975
securityfocus.com/bid/61607
bugs.debian.org/cgi-bin/bugreport.cgi?bug=718682
lists.opensuse.org/opensuse-updates/2013-10/msg00029.html
Show 9 moreShow less
openwall.com/lists/oss-security/2013/08/22/3
nvd.nist.gov/vuln/detail/CVE-2013-4276
github.com/advisories/GHSA-7g29-grmj-m4x3
advisories.mageia.org/MGASA-2013-0260.html
bugs.mageia.org/show_bug.cgi?id=11057
suse.com/security/cve/CVE-2009-0793