CVE-2016-10165

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-02-03 · updated 2026-10-15
Weakness: CWE-125

Description

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04
Debian Linux: 8.0
littlecms Little Cms Color Engine: before 2.11 — fixed in 2.11
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp E-Series Santricity Management: all versions
E-Series SANtricity OS Controller Software 11.x: 11.0, 11.0.0, 11.20, 11.25, 11.30, 11.30.5r3 (+12)
NetApp Oncommand Balance: all versions
OnCommand Insight: all versions
NetApp Oncommand Performance Manager: all versions
NetApp Oncommand Shift: all versions
NetApp OnCommand Unified Manager for 7-Mode (core package): 7.1
openSUSE Leap: 42.1
RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
Red Hat Satellite 6: 5.8

How to fix

Upgrade to a fixed version: littlecms Little Cms Color Engine 2.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-10165 or the next vulnerability affects your stack