Every CVESearch/Get API key

CVE-2013-4276

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...

4.3 MediumFix available

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.

Exploit likelihood

4.04%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used4.3

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.

Record
CVE-2013-4276
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.

Record
CVE-2013-4276
Updated
2026-11-02
EUVDEUVD-2013-4175No score

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.

Record
EUVD-2013-4175
Updated
2026-11-03
GitHub AdvisoriesGHSA-7g29-grmj-m4x3No score

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...

Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.

Record
GHSA-7g29-grmj-m4x3
Weakness
CWE-119
Updated
2026-11-02
OSVMGASA-2013-0260No score

Updated lcms package fixes security vulnerability

Three buffer overflows in Little CMS version 1.19 that could possibly be exploited through user input (CVE-2013-4276).

Record
MGASA-2013-0260
Updated
2026-11-02
OSVopenSUSE-SU-2024:10340-1No score

lcms-1.19-19.8 on GA media

These are all security issues fixed in the lcms-1.19-19.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10340-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lcms
Mageia:2
before 1.19-6.1.mga2
1.19-6.1.mga2
lcms
Mageia:3
before 1.19-7.1.mga3
1.19-7.1.mga3
lcms
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 1.19-19.8
1.19-19.8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4276 is a medium vulnerability (CVSS 4.3) in Littlecms Little Cms Color Engine, published August 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.04%, the 90th percentile. Fixed in lcms 1.19-6.1.mga2.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open