{"id":"CVE-2013-4276","aliases":["EUVD-2013-4175","GHSA-7g29-grmj-m4x3","MGASA-2013-0260","openSUSE-SU-2024:10340-1"],"status":"published","title":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...","description":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0404,"percentile":0.90678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-08-26T19:50:56Z","modified":"2026-06-16T23:56:56Z","fixes":[{"ecosystem":"Mageia:2","package":"lcms","fixed_in":["1.19-6.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"lcms","fixed_in":["1.19-7.1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:2","package":"lcms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19-6.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"lcms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19-7.1.mga3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lcms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19-19.8"}]}],"bundled":2}],"products":[{"vendor":"littlecms","product":"little_cms_color_engine"}],"references":[{"url":"https://usn.ubuntu.com/3770-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=992975","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.securityfocus.com/bid/61607","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718682","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-10/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991757","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-10/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/22/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4276"},{"url":"https://usn.ubuntu.com/3770-2"},{"url":"https://github.com/advisories/GHSA-7g29-grmj-m4x3"},{"url":"https://advisories.mageia.org/MGASA-2013-0260.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11057","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/21/19","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4276","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4276","description":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.","status":"published","published":"2013-09-28T19:00:00Z","modified":"2024-08-06T16:38:01.949Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4175","description":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.","status":"published","published":"2013-09-28T19:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.70868Z"}],"ghsa":[{"id":"GHSA-7g29-grmj-m4x3","title":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow...","description":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.","status":"published","published":"2022-05-14T02:58:25Z","modified":"2025-04-11T04:15:19Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-4276","description":"Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility.","status":"published","published":"2013-09-28T19:55:03.163Z","modified":"2026-06-16T23:56:56.15Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"MGASA-2013-0260","title":"Updated lcms package fixes security vulnerability","description":"Three buffer overflows in Little CMS version 1.19 that could possibly be\nexploited through user input (CVE-2013-4276).\n","status":"published","published":"2013-08-26T19:50:56Z","modified":"2026-04-16T06:24:25.507572554Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10340-1","title":"lcms-1.19-19.8 on GA media","description":"These are all security issues fixed in the lcms-1.19-19.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:44:48.187711Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}