CVE-2016-10165

EPSS 0.87%
Published 03.02.2017 19:59:00
Last modified 20.04.2025 01:37:25
Source cve@mitre.org
Teams watchlist Login
Open Login

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Affected products Warnungen 0 Metrics 3 CWE 1 References 22

Data is provided by the National Vulnerability Database (NVD)

Littlecms ≫ Little Cms Color Engine Version < 2.11

Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm

Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm

Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm

Canonical ≫ Ubuntu Linux Version18.04 SwEditionesm

Debian ≫ Debian Linux Version8.0

Opensuse ≫ Leap Version42.1

Redhat ≫ Satellite Version5.8

Redhat ≫ Enterprise Linux Desktop Version5.0

Redhat ≫ Enterprise Linux Desktop Version6.0

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Server Version5.0

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Aus Version7.3

Redhat ≫ Enterprise Linux Server Aus Version7.4

Redhat ≫ Enterprise Linux Server Aus Version7.6

Redhat ≫ Enterprise Linux Server Aus Version7.7

Redhat ≫ Enterprise Linux Server Eus Version7.3

Redhat ≫ Enterprise Linux Server Eus Version7.4

Redhat ≫ Enterprise Linux Server Eus Version7.5

Redhat ≫ Enterprise Linux Server Eus Version7.6

Redhat ≫ Enterprise Linux Server Eus Version7.7

Redhat ≫ Enterprise Linux Server Tus Version7.3

Redhat ≫ Enterprise Linux Server Tus Version7.6

Redhat ≫ Enterprise Linux Server Tus Version7.7

Redhat ≫ Enterprise Linux Workstation Version5.0

Redhat ≫ Enterprise Linux Workstation Version6.0

Redhat ≫ Enterprise Linux Workstation Version7.0

Netapp ≫ Active Iq Unified Manager SwPlatformwindows Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatformvmware_vsphere Version >= 9.5

Netapp ≫ E-series Santricity Management Version- SwPlatformvmware_sra

Netapp ≫ E-series Santricity Management Version- SwPlatformvmware_vasa

Netapp ≫ E-series Santricity Management Version- SwPlatformvmware_vcenter

Netapp ≫ E-series Santricity Os Controller Version11.0

Netapp ≫ E-series Santricity Os Controller Version11.0.0

Netapp ≫ E-series Santricity Os Controller Version11.20

Netapp ≫ E-series Santricity Os Controller Version11.25

Netapp ≫ E-series Santricity Os Controller Version11.30

Netapp ≫ E-series Santricity Os Controller Version11.30.5r3

Netapp ≫ E-series Santricity Os Controller Version11.40

Netapp ≫ E-series Santricity Os Controller Version11.40.3r2

Netapp ≫ E-series Santricity Os Controller Version11.40.5

Netapp ≫ E-series Santricity Os Controller Version11.50.1

Netapp ≫ E-series Santricity Os Controller Version11.50.2 Update-

Netapp ≫ E-series Santricity Os Controller Version11.50.2 Updatep1

Netapp ≫ E-series Santricity Os Controller Version11.60

Netapp ≫ E-series Santricity Os Controller Version11.60.0

Netapp ≫ E-series Santricity Os Controller Version11.60.1

Netapp ≫ E-series Santricity Os Controller Version11.60.3

Netapp ≫ E-series Santricity Os Controller Version11.70.1

Netapp ≫ E-series Santricity Os Controller Version11.70.2

Netapp ≫ Oncommand Balance Version-

Netapp ≫ Oncommand Insight Version-

Netapp ≫ Oncommand Performance Manager Version- SwPlatformvmware_vsphere

Netapp ≫ Oncommand Shift Version-

Netapp ≫ Oncommand Unified Manager Version- SwPlatform7-mode

Netapp ≫ Oncommand Unified Manager Version7.1 SwPlatformvmware_vsphere

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.87%	0.743

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.1	1.8	5.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:P/I:N/A:P

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Patch

https://usn.ubuntu.com/3770-2/

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2079.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2658.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.html

Third Party Advisory

http://www.debian.org/security/2017/dsa-3774

Third Party Advisory

http://www.openwall.com/lists/oss-security/2017/01/23/1

Patch

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2017/01/25/14

Patch

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/95808

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1039596

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2017:2999

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3046

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3264

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3267

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3268

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3453

Third Party Advisory

https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2

Patch

Third Party Advisory

Issue Tracking

https://security.netapp.com/advisory/ntap-20171019-0001/

Third Party Advisory

https://usn.ubuntu.com/3770-1/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2016-10165

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-10165

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-10165

EUVD