CVE-2016-10165
Publication date 3 February 2017
Last updated 25 August 2025
Ubuntu priority
Description
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| lcms2 | 18.04 LTS bionic |
Fixed 2.8-4
|
| 17.10 artful | Ignored end of life | |
| 17.04 zesty | Ignored end of life | |
| 16.10 yakkety | Ignored end of life | |
| 16.04 LTS xenial |
Fixed 2.6-3ubuntu2.1
|
|
| 14.04 LTS trusty |
Fixed 2.5-0ubuntu4.2
|
|
| 12.04 LTS precise | Ignored end of life | |
| openjdk-7 | 18.04 LTS bionic | Not in release |
| 17.10 artful | Not in release | |
| 17.04 zesty | Not in release | |
| 16.10 yakkety | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Fixed 7u121-2.6.8-1ubuntu0.14.04.1
|
|
| 12.04 LTS precise |
Fixed 7u121-2.6.8-1ubuntu0.12.04.1
|
|
| openjdk-8 | 18.04 LTS bionic |
Not affected
|
| 17.10 artful |
Not affected
|
|
| 17.04 zesty |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release |
Notes
sbeattie
openjdk-7 as of 7u111-2.6.7 uses embedded copy of lcms2 (see http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1896)
Patch details
For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?
| Package | Patch details |
|---|---|
| lcms2 |
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score 7.1 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3770-2
- Little CMS vulnerabilities
- 20 September 2018
- USN-3770-1
- Little CMS vulnerabilities
- 20 September 2018