Back to CVE records
High 7.1Published Feb 3, 2017
CVE-2016-10165The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which…
Updated under an hour ago ()
Does this affect you?
It affects littlecms little_cms_color_engine and 18 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
- CVSS
- 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
littlecms little_cms_color_engine littlecms:little_cms_color_engine | before 2.11 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 12.04; 14.04; 16.04; 18.04 | NVD |
debian debian_linux debian:debian_linux | 8.0 | NVD |
opensuse leap opensuse:leap | 42.1 | NVD |
redhat satellite redhat:satellite | 5.8 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 5.0; 6.0; 7.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 5.0; 6.0; 7.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 7.3; 7.4; 7.6; 7.7 | NVD |
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus | 7.3; 7.4; 7.5; 7.6; 7.7 | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 7.3; 7.6; 7.7 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 5.0; 6.0; 7.0 | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | from 7.3; from 9.5 | NVD |
netapp e-series_santricity_management netapp:e-series_santricity_management | all versions; all versions; all versions | NVD |
netapp e-series_santricity_os_controller netapp:e-series_santricity_os_controller | 11.0; 11.0.0; 11.20; 11.25; 11.30; 11.30.5r3; 11.40; 11.40.3r2; and 10 more ranges | NVD |
netapp oncommand_balance netapp:oncommand_balance | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp oncommand_performance_manager netapp:oncommand_performance_manager | all versions | NVD |
netapp oncommand_shift netapp:oncommand_shift | all versions | NVD |
netapp oncommand_unified_manager netapp:oncommand_unified_manager | all versions; 7.1 | NVD |
References
- https://usn.ubuntu.com/3770-2/vendor-advisory, x-refsource-ubuntu, third-party-advisory
- http://www.debian.org/security/2017/dsa-3774vendor-advisory, x-refsource-debian, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2016-2079.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- https://usn.ubuntu.com/3770-1/vendor-advisory, x-refsource-ubuntu, third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:3267vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:3268vendor-advisory, x-refsource-redhat, third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlx-refsource-confirm, patch
- https://access.redhat.com/errata/RHSA-2017:3046vendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.htmlvendor-advisory, x-refsource-suse, third-party-advisory
- http://www.securityfocus.com/bid/95808vdb-entry, x-refsource-bid, third-party-advisory
- http://www.securitytracker.com/id/1039596vdb-entry, x-refsource-sectrack, third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:3264vendor-advisory, x-refsource-redhat, third-party-advisory
- http://www.openwall.com/lists/oss-security/2017/01/25/14mailing-list, x-refsource-mlist, patch, third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:3453vendor-advisory, x-refsource-redhat, third-party-advisory
- https://security.netapp.com/advisory/ntap-20171019-0001/x-refsource-confirm, third-party-advisory
- http://www.openwall.com/lists/oss-security/2017/01/23/1mailing-list, x-refsource-mlist, patch, third-party-advisory
- https://access.redhat.com/errata/RHSA-2017:2999vendor-advisory, x-refsource-redhat, third-party-advisory
- https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2x-refsource-confirm, issue-tracking, patch, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2016-2658.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.