CVE-2016-10165
- Source
- https://cve.org/CVERecord?id=CVE-2016-10165
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10165.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-10165
- Downstream
- Related
- Published
- 2017-02-03T19:59:00.177Z
- Modified
- 2026-05-18T12:49:11.782457Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The TypeMLURead function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*" ], "extracted_events": [ { "last_affected": "12.04" }, { "last_affected": "14.04" }, { "last_affected": "16.04" }, { "last_affected": "18.04" } ], "source": "CPE_FIELD", "vendor_product": "canonical:ubuntu_linux" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "8.0" } ], "source": "CPE_FIELD", "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*", "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*" ], "extracted_events": [ { "introduced": "7.3" }, { "introduced": "9.5" } ], "source": "CPE_FIELD", "vendor_product": "netapp:active_iq_unified_manager" }, { "cpes": [ "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.20:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.25:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.30.5r3:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.30:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40.3r2:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40.5:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.50.1:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.50.2:-:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.50.2:p1:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.0:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.1:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.3:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.70.1:*:*:*:*:*:*:*", "cpe:2.3:a:netapp:e-series_santricity_os_controller:11.70.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "11.0" }, { "last_affected": "11.0.0" }, { "last_affected": "11.20" }, { "last_affected": "11.25" }, { "last_affected": "11.30" }, { "last_affected": "11.30.5r3" }, { "last_affected": "11.40" }, { "last_affected": "11.40.3r2" }, { "last_affected": "11.40.5" }, { "last_affected": "11.50.1" }, { "last_affected": "11.50.2-NA" }, { "last_affected": "11.50.2-p1" }, { "last_affected": "11.60" }, { "last_affected": "11.60.0" }, { "last_affected": "11.60.1" }, { "last_affected": "11.60.3" }, { "last_affected": "11.70.1" }, { "last_affected": "11.70.2" } ], "source": "CPE_FIELD", "vendor_product": "netapp:e-series_santricity_os_controller" }, { "cpes": [ "cpe:2.3:a:netapp:oncommand_unified_manager:7.1:*:*:*:*:vmware_vsphere:*:*" ], "extracted_events": [ { "last_affected": "7.1" } ], "source": "CPE_FIELD", "vendor_product": "netapp:oncommand_unified_manager" }, { "cpes": [ "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "42.1" } ], "source": "CPE_FIELD", "vendor_product": "opensuse:leap" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "5.0" }, { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_desktop" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "5.0" }, { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "7.3" }, { "last_affected": "7.4" }, { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server_aus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "7.3" }, { "last_affected": "7.4" }, { "last_affected": "7.5" }, { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server_eus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "7.3" }, { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_server_tus" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "5.0" }, { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "source": "CPE_FIELD", "vendor_product": "redhat:enterprise_linux_workstation" }, { "cpes": [ "cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "5.8" } ], "source": "CPE_FIELD", "vendor_product": "redhat:satellite" } ] }- References
-
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.html
- http://rhn.redhat.com/errata/RHSA-2016-2079.html
- http://rhn.redhat.com/errata/RHSA-2016-2658.html
- http://www.debian.org/security/2017/dsa-3774
- http://www.securityfocus.com/bid/95808
- http://www.securitytracker.com/id/1039596
- https://access.redhat.com/errata/RHSA-2017:2999
- https://access.redhat.com/errata/RHSA-2017:3046
- https://access.redhat.com/errata/RHSA-2017:3264
- https://access.redhat.com/errata/RHSA-2017:3267
- https://access.redhat.com/errata/RHSA-2017:3268
- https://access.redhat.com/errata/RHSA-2017:3453
- https://security.netapp.com/advisory/ntap-20171019-0001/
- https://usn.ubuntu.com/3770-1/
- https://usn.ubuntu.com/3770-2/
- http://www.openwall.com/lists/oss-security/2017/01/23/1
- http://www.openwall.com/lists/oss-security/2017/01/25/14
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2
Affected packages
Git / github.com/mm2/little-cms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mm2/little-cms
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2.11" } ], "source": [ "CPE_FIELD", "REFERENCES" ], "cpe": "cpe:2.3:a:littlecms:little_cms_color_engine:*:*:*:*:*:*:*:*" }
Affected versions
lcms2-2.*
lcms2-2.7
lcms2.*
lcms2.10
lcms2.10rc1
lcms2.2
lcms2.2rc0
lcms2.2rc1
lcms2.2rc2
lcms2.3
lcms2.3rc1
lcms2.3rc2
lcms2.3rc3
lcms2.4
lcms2.4rc1
lcms2.4rc2
lcms2.5
lcms2.5rc1
lcms2.5rc2
lcms2.5rc3
lcms2.6
lcms2.6rc0
lcms2.6rc1
lcms2.6rc3
lcms2.7rc1
lcms2.7rc2
lcms2.7rc3
lcms2.8
lcms2.8rc2
lcms2.9
lcms2.9rc1
Database specific
vanir_signatures_modified
"2026-05-18T12:49:11Z"
vanir_signatures
[
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2016-10165-5823015a",
"signature_version": "v1",
"digest": {
"function_hash": "193084025655828714120386110864385602689",
"length": 1686.0
},
"source": "https://github.com/mm2/little-cms/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2",
"target": {
"file": "src/cmstypes.c",
"function": "Type_MLU_Read"
}
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2016-10165-f46349fe",
"signature_version": "v1",
"digest": {
"line_hashes": [
"174146422431459820255007659617750688561",
"78268650681982427652376948030072086009",
"22910717854434003833771298674182363943",
"221774076812319222840572722321423837729"
],
"threshold": 0.9
},
"source": "https://github.com/mm2/little-cms/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2",
"target": {
"file": "src/cmstypes.c"
}
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10165.json"