Out-of-Bounds Heap Read Vulnerability in lcms2 Package
Summary
ALPINE-CVE-2016-10165: The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bo... Affects lcms2 versions < 2.8-r1. Fixed in 2.8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lcms2 is an open-source color management engine that provides a framework for color space conversions and ICC profile handling. It is widely used in various applications for accurate color representation. However, it has been found to be vulnerable to a specific issue that can lead to security risks, particularly when processing crafted ICC profiles.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10165, originates from the Type_MLU_Read function in the cmstypes.c file of the lcms2 package. It allows remote attackers to exploit the vulnerability by sending specially crafted images with malicious ICC profiles. This can lead to sensitive information disclosure or a denial of service due to an out-of-bounds heap read. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.8-r1
This is the first release that contains the fix.
sudo apk add --upgrade lcms2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to filter out potentially harmful ICC profiles before processing them. This can help mitigate the risk of exploitation.
Conclusion
The lcms2 package has a significant vulnerability (CVE-2016-10165) that can lead to serious security issues if not addressed. It is crucial to update to the patched version 2.8-r1 to mitigate risks. Additionally, using tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for lcms2 →
FAQ
CVE-2016-10165 is a vulnerability in the lcms2 package that allows remote attackers to exploit out-of-bounds heap reads through crafted ICC profiles.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include sensitive information disclosure and denial of service, which can affect the stability and security of applications using the lcms2 package.
Yes, the patched version of the lcms2 package is 2.8-r1. Updating to this version will resolve the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for lcms2.
