CVE-2009-0733

Name	CVE-2009-0733
Description	Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-1745-1, DSA-1769-1
NVD severity	high (attack range: remote, user-initiated)
Debian Bugs	522446
Debian/oldstable	not vulnerable.
Debian/stable	not vulnerable.
Debian/testing	not known to be vulnerable.
Debian/unstable	not vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lcms (PTS)	squeeze	1.18.dfsg-1.2	fixed
	wheezy	1.19.dfsg-1.2	fixed
openjdk-6 (PTS)	squeeze	6b18-1.8.13-0+squeeze2	fixed
	squeeze (security)	6b31-1.13.3-1~deb6u1	fixed
	squeeze (lts)	6b34-1.13.6-1~deb6u1	fixed
	wheezy	6b27-1.12.5-1	fixed
	wheezy (security)	6b34-1.13.6-1~deb7u1	fixed
	sid	6b34-1.13.6-1	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
lcms	source	(unstable)	1.18.dfsg-1	high		522446
lcms	source	etch	1.15-1.1+etch2	high	DSA-1745-1
lcms	source	lenny	1.17.dfsg-1+lenny1	high	DSA-1745-1
openjdk-6	source	(unstable)	6b18-1.8.13-0+squeeze2	high
openjdk-6	source	lenny	6b11-9.1+lenny2	high	DSA-1769-1

Marking the current oldstable version as fixed, but likely fixed way earlier