What is the CVSS score of CVE-2016-10165?

CVE-2016-10165 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.9%.

Is there a patch available for CVE-2016-10165?

Yes, a patch is available for CVE-2016-10165. Update the affected software to the latest version immediately.

Little Cms Color Engine CVE-2016-10165

HIGH

Out-of-bounds Read (CWE-125)

2017-02-03 cve@mitre.org

Buffer Overflow Denial Of Service Information Disclosure Little Cms Color Engine Ubuntu Linux Debian Linux Leap Satellite Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Eus Enterprise Linux Server Tus Enterprise Linux Workstation Active Iq Unified Manager E Series Santricity Management E Series Santricity Os Controller Oncommand Balance Oncommand Insight Oncommand Performance Manager Oncommand Shift Oncommand Unified Manager

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Feb 03, 2017 - 19:59 cve.org

HIGH 7.1

DescriptionCVE.org

AnalysisAI

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read. Affected products include: Littlecms Little Cms Color Engine, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Redhat Satellite.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.