CVE-2012-1616: Use After Free
A Use-after-free vulnerability was found in the way icclib, a library used for reading and writing of color profile files that conform to the International Color Consortium (ICC) Profile Format Specification, processed certain crafted ICC profile files. The ICC Profile Format is a cross-platform device profile format that can be used to translate color data created on one device into another device's native color space.
A remote attacker could provide a specially crafted file and trick a local user into opening it, which could lead to arbitrary code execution with the privileges of the user running an application linked against icclib.
Red Hat would like to thank Marc Schoenefeld for reporting this flaw.
Other sources
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1616?
CVE-2012-1616 is classified as a moderate severity vulnerability due to the potential for use-after-free exploits in affected applications.
How do I fix CVE-2012-1616?
To fix CVE-2012-1616, update the affected ArgyllCMS or icclib software to the patched version that addresses the vulnerability.
What software is affected by CVE-2012-1616?
CVE-2012-1616 affects multiple versions of ArgyllCMS and icclib software, especially versions prior to 1.3.7 for ArgyllCMS and 2.11 for icclib.
What type of vulnerability is CVE-2012-1616?
CVE-2012-1616 is a use-after-free vulnerability that occurs when the software improperly handles memory management of ICC profile files.
Can exploiting CVE-2012-1616 lead to system compromise?
Yes, exploiting CVE-2012-1616 may allow an attacker to execute arbitrary code, potentially leading to system compromise.