Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2009-0733

28
FAUCET Score

CVE-2009-0733 is a critical stack-based buffer overflow vulnerability affecting LittleCMS (lcms) versions prior to 1.18beta2, impacting products like Firefox, OpenJDK, and GIMP. This flaw allows remote attackers to execute arbitrary code by crafting malicious image files with large integer values in the input or output channels. With a CVSS score of 9.3, it presents a high risk due to its network-based attack vector, medium attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered some community discussion, indicating awareness within the security community.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.9.2CPE matchmatch criteria
cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*
3.1CPE matchmatch criteria
cpe:2.3:a:mozilla:firefox:3.1:beta1:*:*:*:*:*:*
<= 7CPE matchmatch criteria
cpe:2.3:a:sun:openjdk:*:*:*:*:*:*:*:*
<= 1.17CPE matchmatch criteria
cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

9.3HIGH

AV:N/AC:M/Au:N/C:C/I:C/A:C

Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
10.0
CvssVersion
2.0

Exploit Intelligence

EPSS Score
5.53%
Probability of exploitation in next 30 days
EPSS Percentile
92.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0553 is in the 62nd percentile among its peer group of 8,914 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: lcms-0:1.18-0.1.beta1.el5_3.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: java-1.6.0-openjdk-1:1.6.0.0-0.30.b09.el5
View patch

Vendor Advisories (1)

redhatCVE-2009-0733Moderate

LittleCms lack of upper-bounds check on sizes

Mar 19, 2009

References

lists.opensuse.org / opensuse-security-announce/2009-03/msg00004.html
Third Party Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
scarybeastsecurity.blogspot.com / 2009/03/littlecms-vulnerabilities.html
Exploit
scary.beasts.org / security/CESA-2009-003.html
Exploit
secunia.com / advisories/34367
Broken Link
secunia.com / advisories/34382
Broken Link
secunia.com / advisories/34400
Broken Link
secunia.com / advisories/34408
Broken Link
secunia.com / advisories/34418
Broken Link
secunia.com / advisories/34442
Broken Link
secunia.com / advisories/34450
Broken Link
secunia.com / advisories/34454
Broken Link
secunia.com / advisories/34463
Broken Link
secunia.com / advisories/34632
Broken Link
secunia.com / advisories/34675
Broken Link
secunia.com / advisories/34782
Broken Link
security.gentoo.org / glsa/glsa-200904-19.xml
Third Party Advisory
exchange.xforce.ibmcloud.com / vulnerabilities/49330
Third Party AdvisoryVDB Entry
slackware.com / security/viewer.php
Third Party Advisory
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9742
Tool Signature
rhn.redhat.com / errata/RHSA-2009-0377.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00794.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00799.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00811.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00851.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00856.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00857.html
Third Party Advisory
redhat.com / archives/fedora-package-announce/2009-March/msg00921.html
Third Party Advisory
debian.org / security/2009/dsa-1745
Third Party Advisory
debian.org / security/2009/dsa-1769
Third Party Advisory
mandriva.com / security/advisories
Broken Link
mandriva.com / security/advisories
Broken Link
mandriva.com / security/advisories
Broken Link
ocert.org / advisories/ocert-2009-003.html
Third Party Advisory
redhat.com / support/errata/RHSA-2009-0339.html
Third Party Advisory
securityfocus.com / archive/1/502018/100/0/threaded
Third Party AdvisoryVDB Entry
securityfocus.com / archive/1/502031/100/0/threaded
Third Party AdvisoryVDB Entry
securityfocus.com / bid/34185
Broken LinkThird Party AdvisoryVDB Entry
securitytracker.com / id
Broken LinkThird Party AdvisoryVDB Entry
ubuntu.com / usn/USN-744-1
Third Party Advisory
vupen.com / english/advisories/2009/0775
Broken Link