CVE-2009-0581

Exp

Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.

Published: 2009-03-23 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2009-0581 is rated High Exploit Risk (60.9/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.89%). 2 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2009-0581

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2009-0581

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-01 2.12% 1.89% -0.23%
2 2025-03-30 3.19% 2.12% -1.07%
3 2025-03-29 — 3.19% —

Full EPSS history (10 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-0581

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2009-0581

OS Trackers for CVE-2009-0581

vendor priority summary link
gentoo normal CVE-2009-0581: 1 GLSA(s) (200904-19), 1 atom(s) (media-libs/lcms); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-0581
redhat low — https://access.redhat.com/security/cve/CVE-2009-0581
ubuntu low CVE-2009-0581 low priority: Ubuntu including 1 source packages (lcms), 5 status rows across 5 suites (dapper, gutsy, hardy, intrepid, upstream): released 5. https://ubuntu.com/security/CVE-2009-0581

Affected software / configurations for CVE-2009-0581

Vendor Product Version Raw CPE
littlecms little_cms <= 1.17 cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*
gimp gimp < 2.9.2 cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*
mozilla firefox 3.1 cpe:2.3:a:mozilla:firefox:3.1:beta1:*:*:*:*:*:*
oracle openjdk <= 7 cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*

References for CVE-2009-0581

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html Third Party Advisory
http://scary.beasts.org/security/CESA-2009-003.html Exploit
http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html Exploit
http://secunia.com/advisories/34367 Broken Link
http://secunia.com/advisories/34382 Broken Link
http://secunia.com/advisories/34400 Broken Link
http://secunia.com/advisories/34408 Broken Link
http://secunia.com/advisories/34418 Broken Link
http://secunia.com/advisories/34442 Broken Link
http://secunia.com/advisories/34450 Broken Link
http://secunia.com/advisories/34454 Broken Link
http://secunia.com/advisories/34463 Broken Link
http://secunia.com/advisories/34632 Broken Link
http://secunia.com/advisories/34675 Broken Link
http://secunia.com/advisories/34782 Broken Link
http://security.gentoo.org/glsa/glsa-200904-19.xml Third Party Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438 Third Party Advisory
http://www.debian.org/security/2009/dsa-1745 Third Party Advisory
http://www.debian.org/security/2009/dsa-1769 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:121 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2009:137 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2009:162 Broken Link
http://www.ocert.org/advisories/ocert-2009-003.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0339.html Third Party Advisory
http://www.securityfocus.com/archive/1/502018/100/0/threaded Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/502031/100/0/threaded Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/34185 Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021870 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-744-1 Third Party Advisory
http://www.vupen.com/english/advisories/2009/0775 Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=487509 Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/49328 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023 Tool Signature
https://rhn.redhat.com/errata/RHSA-2009-0377.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html Third Party Advisory
cvelogic Threat Intelligence