CVE-2016-10165

HIGH

7.1

CVSS Score

Published: February 3, 2017 at 07:00 PM UTC

Updated: October 15, 2026 at 04:17 PM UTC

19 products affected across 6 vendorsDebian LinuxUbuntu LinuxEnterprise Linux Desktop

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 3%

SSVC

No known exploit

Description

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

12.04 14.04 16.04 18.04

Debian Linux · Debiandrupal

95%

8.0

Little CMS Color Engine · Littlecms

95%

v < 2.11

Affected range stops below 2.11, so it looks safe — our inference, not a vendor statement

Active IQ Unified Manager · NetAppnpm

95%

v ≥ 7.3v ≥ 9.5

E Series Santricity Management · NetApp

95%

All versions

E Series Santricity OS Controller · NetApp

95%

11.0 11.0.0 11.20 11.25 11.30 11.30.5r3 11.40 11.40.3r2 11.40.5 11.50.1 11.50.2 11.50.2 p1 11.60 11.60.0 11.60.1 11.60.3 11.70.1 11.70.2

Oncommand Balance · NetApp

95%

All versions

OnCommand Insight · NetAppdrupal

95%

All versions

Oncommand Performance Manager · NetApp

95%

All versions

Oncommand Shift · NetApp

95%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (19)

Vendor Advisoryx_refsource_SUSEThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.html

Vendor Advisoryx_refsource_REDHATThird Party Advisory

Source: [email protected]

http://rhn.redhat.com/errata/RHSA-2016-2079.html

Vendor Advisoryx_refsource_REDHATThird Party Advisory

Source: [email protected]

http://rhn.redhat.com/errata/RHSA-2016-2658.html

Vendor Advisoryx_refsource_DEBIANThird Party Advisory

Source: [email protected]

http://www.debian.org/security/2017/dsa-3774

Mailing Listx_refsource_MLISTPatchThird Party Advisory

Source: [email protected]

http://www.openwall.com/lists/oss-security/2017/01/23/1

Mailing Listx_refsource_MLISTPatchThird Party Advisory

Source: [email protected]

http://www.openwall.com/lists/oss-security/2017/01/25/14

x_refsource_CONFIRMPatch

Source: [email protected]

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

VDB Entryx_refsource_BIDThird Party Advisory

Source: [email protected]

http://www.securityfocus.com/bid/95808

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGH[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card