Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 591452 (CVE-2016-10165) - <media-libs/lcms-2.8-r1: Out-of-bounds read in Type_MLU_Read() (CVE-2016-10165)
Summary: <media-libs/lcms-2.8-r1: Out-of-bounds read in Type_MLU_Read() (CVE-2016-10165)
Alias: CVE-2016-10165
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa]
Depends on:
Reported: 2016-08-17 11:43 UTC by Agostino Sarubbo
Modified: 2017-11-05 16:51 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---
stable-bot: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-08-17 11:43:10 UTC
From ${URL} :

An out-of-bounds read in cmstypes.c in Type_MLU_Read function was found, leading to heap memory leak triggered by crafted ICC profile.

Upstream patch:

CVE request:

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-26 16:00:34 UTC
lcms is bundled in various OpenJDK releases, we will need to check that.
Comment 2 Andreas K. Hüttel archtester gentoo-dev 2017-01-27 21:05:53 UTC
Added the patch. Testing now.
Comment 3 Andreas K. Hüttel archtester gentoo-dev 2017-02-19 17:57:14 UTC
(In reply to Andreas K. Hüttel from comment #2)
> Added the patch. Testing now.

I see no bug explosion, so let's go ahead. 

Arches please stabilize, target: all stable arches

Comment 4 Agostino Sarubbo gentoo-dev 2017-02-20 10:07:12 UTC
amd64 stable
Comment 5 Tobias Klausmann (RETIRED) gentoo-dev 2017-02-21 11:54:59 UTC
Stable on alpha.
Comment 6 Jeroen Roovers (RETIRED) gentoo-dev 2017-02-22 08:08:25 UTC
Stable for HPPA.
Comment 7 Agostino Sarubbo gentoo-dev 2017-02-22 16:08:22 UTC
x86 stable
Comment 8 Michael Weber (RETIRED) gentoo-dev 2017-02-22 21:26:27 UTC
arm ppc64 stable.
Comment 9 Michael Weber (RETIRED) gentoo-dev 2017-02-22 21:59:10 UTC
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2017-02-25 10:04:31 UTC
sparc stable
Comment 11 Agostino Sarubbo gentoo-dev 2017-03-11 17:10:43 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 12 Andreas K. Hüttel archtester gentoo-dev 2017-03-11 18:07:48 UTC
Vulnerable versions removed
Comment 13 Thomas Deutschmann (RETIRED) gentoo-dev 2017-03-14 11:14:53 UTC
GLSA Vote: No

Repository is clean, all done.