CVE-2016-10165: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2016-10165 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 2.76% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 17 · Related 9Timeline
- 03-02-2017PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
2.76%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.76% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp8 products
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- e-series_santricity_managementna
- e-series_santricity_os_controller11.0 | 11.0.0 | 11.20 | 11.25 | 11.30 | 11.30.5r3 | 11.40 | 11.40.3r2 | 11.40.5 | 11.50.1 | 11.50.2 | 11.50.2:p1 | 11.60 | 11.60.0 | 11.60.1 | 11.60.3 | 11.70.1 | 11.70.2
- oncommand_balancena
- oncommand_insightna
Redhat7 products
- enterprise_linux_desktop5.0 | 6.0 | 7.0
- enterprise_linux_server5.0 | 6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server_tus7.3 | 7.6 | 7.7
Debian2 products
- lcms2< 2.6-3+deb8u1 | < 2.2+git20110628-2.2+deb7u2 | < 2.8-4
- debian_linuxEOL8.0
Ubuntu2 products
- lcms2< 2.5-0ubuntu4.2 | < 2.6-3ubuntu2.1 | < 2.8-4
- openjdk-7< 7u121-2.6.8-1ubuntu0.14.04.1
Alpine1 product
- lcms2< 2.8-r1 | < 2.8-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04
Littlecms1 product
- little_cms_color_engine< 2.11
Opensuse1 product
- leapEOL42.1
8 vendors · 23 products
References
26 links
- lists.opensuse.org/opensuse-updates/2017-01/msg00174.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
Show all 26 references
- www.openwall.com/lists/oss-security/2017/01/25/14Mailing ListX Refsource MLISTPatchThird Party AdvisoryREPORT
- www.openwall.com/lists/oss-security/2017/01/23/1Mailing ListX Refsource MLISTPatchThird Party Advisory
- github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2X Refsource CONFIRMIssue TrackingPatchThird Party Advisory