Explore top 10 tips to secure your open-source projects now. Read More
×
This update for lcms2 fixes the following security issues: - CVE-2016-10165: The Type_MLU_Read function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read (bsc#1021364). - CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813) - Ensure that LUT stages match channel count (bsc#1026649). - sanitize input and output channels on MPE profiles (bsc#1026650). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
#1021364 #1026649 #1026650 #1108813
Cross- CVE-2016-10165 CVE-2018-16435
Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Desktop 12-SP3
https://www.suse.com/security/cve/CVE-2016-10165.html
https://www.suse.com/security/cve/CVE-2018-16435.html
https://bugzilla.suse.com/1021364
https://bugzilla.suse.com/1026649
https://bugzilla.suse.com/1026650
https://bugzilla.suse.com/1108813
Get the latest Linux and open source security news straight to your inbox.