CVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image wi…
Published Feb 3, 2017 · updated Oct 15, 2026 · littlecms little cms color engine
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 3, 2017 · NIST NVD
Detected
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Oct 15, 2026 · NIST NVD
Updated
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Affected
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe debian/debian linux8.0
- cpe littlecms/little cms color engineversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe opensuse/leap42.1
- cpe redhat/satellite5.8
Sources
- CVE.orgVulnerability recordCVE-2016-10165
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
nvd.nist.gov