CVE-2009-0793
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows...
CVE-2009-0793 is a medium vulnerability (CVSS 4.3) in Littlecms Lcms, published April 9, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.83%, the 92nd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 4.83%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-6Debian:5.0 From an advisory covering 12 CVEs | before 6b11-9.1+lenny2, plus listed versions 6b11-9.1 | 6b11-9.1+lenny2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs | before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
lcmsopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.19-19.8 | 1.19-19.8 |
What each source reports
NVD Score used
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
- Record
CVE-2009-0793- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
- Record
CVE-2009-0793- Updated
- 2026-11-02
EUVDEUVD-2009-0791No score
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
- Record
EUVD-2009-0791- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqm3-p699-wmxxNo score
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows...
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
- Record
GHSA-mqm3-p699-wmxx- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10340-1No score
lcms-1.19-19.8 on GA media
These are all security issues fixed in the lcms-1.19-19.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10340-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
mandriva.com/security/advisories?name=MDVSA-2009:137
secunia.com/advisories/34635
redhat.com/archives/fedora-package-announce/2009-May/msg00233.html
ubuntu.com/usn/USN-1043-1
Show 77 moreShow less
vupen.com/english/advisories/2009/0964
rhn.redhat.com/errata/RHSA-2009-0377.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11340
securityfocus.com/bid/34411
bugzilla.redhat.com/show_bug.cgi?id=492353
debian.org/security/2009/dsa-1769
security.gentoo.org/glsa/glsa-200904-19.xml
nvd.nist.gov/vuln/detail/CVE-2009-0793
access.redhat.com/errata/RHSA-2009:0377
github.com/advisories/GHSA-mqm3-p699-wmxx
blogs.sun.com/security/entry/advance_notification_of_security_updates4
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0377.json
cve.org/CVERecord?id=CVE-2006-2426
suse.com/security/cve/CVE-2009-0793