VIR Vulnerability Intelligence Relay

CVE-2016-10165

high
Published 2017-02-03 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.1

Description

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Predictions

Exploit likelihood
70%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormfixed2.8-4
debian debianbullseyefixed2.8-4
debian debianforkyfixed2.8-4
debian debiansidfixed2.8-4
debian debiantrixiefixed2.8-4
debian debian8.0affected
redhat rhel5.0affected
redhat rhel6.0affected
redhat rhel7.0affected
suse suse42.1affected
ubuntu ubuntu12.04affected
ubuntu ubuntu14.04affected
ubuntu ubuntu16.04affected
ubuntu ubuntu18.04affected

Application impact
VendorProductVersionsFixed
littlecmslittle_cms_color_engine{"endExcluding":"2.11"}2.11
redhat redhatsatellite5.8
netappactive_iq_unified_manager{"startIncluding":"7.3"}
netappe-series_santricity_management-
netappe-series_santricity_os_controller11.0
netappe-series_santricity_os_controller11.0.0
netappe-series_santricity_os_controller11.20
netappe-series_santricity_os_controller11.25
netappe-series_santricity_os_controller11.30
netappe-series_santricity_os_controller11.30.5r3
netappe-series_santricity_os_controller11.40
netappe-series_santricity_os_controller11.40.3r2
netappe-series_santricity_os_controller11.40.5
netappe-series_santricity_os_controller11.50.1
netappe-series_santricity_os_controller11.50.2
netappe-series_santricity_os_controller11.60
netappe-series_santricity_os_controller11.60.0
netappe-series_santricity_os_controller11.60.1
netappe-series_santricity_os_controller11.60.3
netappe-series_santricity_os_controller11.70.1
netappe-series_santricity_os_controller11.70.2
netapponcommand_balance-
netapponcommand_insight-
netapponcommand_performance_manager-
netapponcommand_shift-
netapponcommand_unified_manager-
netapponcommand_unified_manager7.1

References

CWEs

CWE-125

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.