CVE-2009-0733

Exp

Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.

Published: 2009-03-23 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2009-0733 is rated High Exploit Risk (88/100): CVSS Critical severity, with high exploitation likelihood (EPSS 5.53%, 92th percentile). 2 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +3.67% over the last day, indicating growing attacker interest. Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2009-0733

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2009-0733

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.86% 5.53% +3.67%
2 2026-04-08 1.60% 1.86% +0.26%
3 2025-12-01 — 1.60% —

Full EPSS history (13 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-0733

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.3 2.0 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 8.6 10.0 [email protected]

Weakness enumeration for CVE-2009-0733

OS Trackers for CVE-2009-0733

vendor priority summary link
gentoo normal CVE-2009-0733: 1 GLSA(s) (200904-19), 1 atom(s) (media-libs/lcms); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-0733
redhat medium — https://access.redhat.com/security/cve/CVE-2009-0733
ubuntu medium CVE-2009-0733 medium priority: Ubuntu including 1 source packages (lcms), 5 status rows across 5 suites (dapper, gutsy, hardy, intrepid, upstream): released 5. https://ubuntu.com/security/CVE-2009-0733

Affected software / configurations for CVE-2009-0733

Vendor Product Version Raw CPE
gimp gimp < 2.9.2 cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*
mozilla firefox 3.1 cpe:2.3:a:mozilla:firefox:3.1:beta1:*:*:*:*:*:*
sun openjdk <= 7 cpe:2.3:a:sun:openjdk:*:*:*:*:*:*:*:*
littlecms little_cms <= 1.17 cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*

References for CVE-2009-0733

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html Third Party Advisory
http://scary.beasts.org/security/CESA-2009-003.html Exploit
http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html Exploit
http://secunia.com/advisories/34367 Broken Link
http://secunia.com/advisories/34382 Broken Link
http://secunia.com/advisories/34400 Broken Link
http://secunia.com/advisories/34408 Broken Link
http://secunia.com/advisories/34418 Broken Link
http://secunia.com/advisories/34442 Broken Link
http://secunia.com/advisories/34450 Broken Link
http://secunia.com/advisories/34454 Broken Link
http://secunia.com/advisories/34463 Broken Link
http://secunia.com/advisories/34632 Broken Link
http://secunia.com/advisories/34675 Broken Link
http://secunia.com/advisories/34782 Broken Link
http://security.gentoo.org/glsa/glsa-200904-19.xml Third Party Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438 Third Party Advisory
http://www.debian.org/security/2009/dsa-1745 Third Party Advisory
http://www.debian.org/security/2009/dsa-1769 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:121 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2009:137 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2009:162 Broken Link
http://www.ocert.org/advisories/ocert-2009-003.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0339.html Third Party Advisory
http://www.securityfocus.com/archive/1/502018/100/0/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/502031/100/0/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/34185 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021869 Broken Link Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-744-1 Third Party Advisory
http://www.vupen.com/english/advisories/2009/0775 Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=487512 Issue Tracking Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49330 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9742 Tool Signature
https://rhn.redhat.com/errata/RHSA-2009-0377.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html Third Party Advisory
cvelogic Threat Intelligence