Fluid Attacks Database

Description

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
alpine v3.5	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.11	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.14	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.17	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.4	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| >=0 <2.8-r0	2.8-r0
alpine v3.6	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.16	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.18	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.9	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1
alpine v3.10	lcms2	=2.5-r0 \|\| =2.6-r0 \|\| =2.7-r0 \|\| =2.7-r1 \|\| =2.8-r0 \|\| >=0 <2.8-r1	2.8-r1

1-10 of 32

Aliases

1. CVE-2016-101652. NVD-2016-101653. OSV-ALPINE-2016-101654. OSV-2016-101655. OSV-DEBIAN-2016-101656. SECURITY-CVE-2016-101657. SECURITY-TRACKER-CVE-2016-10165

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.