CVE-2016-10165

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-10165
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10165.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-10165
Downstream
Related
Published
2017-02-03T19:59:00.177Z
Modified
2026-02-12T23:58:28.187405Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

The TypeMLURead function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

References

Affected packages

Git / github.com/mm2/little-cms

Affected ranges

Type
GIT
Repo
https://github.com/mm2/little-cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5ca71a7bc18b6897ab21d815d15e218e204581e2

Affected versions

lcms2-2.*
lcms2-2.7
lcms2.*
lcms2.2
lcms2.2rc0
lcms2.2rc1
lcms2.2rc2
lcms2.3
lcms2.3rc1
lcms2.3rc2
lcms2.3rc3
lcms2.4
lcms2.4rc1
lcms2.4rc2
lcms2.5
lcms2.5rc1
lcms2.5rc2
lcms2.5rc3
lcms2.6
lcms2.6rc0
lcms2.6rc1
lcms2.6rc3
lcms2.7rc1
lcms2.7rc2
lcms2.7rc3
lcms2.8
lcms2.8rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10165.json"
vanir_signatures 
[
    {
        "source": "https://github.com/mm2/little-cms/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2",
        "digest": {
            "length": 1686.0,
            "function_hash": "193084025655828714120386110864385602689"
        },
        "id": "CVE-2016-10165-5823015a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "target": {
            "file": "src/cmstypes.c",
            "function": "Type_MLU_Read"
        }
    },
    {
        "source": "https://github.com/mm2/little-cms/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2",
        "digest": {
            "line_hashes": [
                "174146422431459820255007659617750688561",
                "78268650681982427652376948030072086009",
                "22910717854434003833771298674182363943",
                "221774076812319222840572722321423837729"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2016-10165-f46349fe",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "target": {
            "file": "src/cmstypes.c"
        }
    }
]