USN-3770-1: Little CMS vulnerabilities

Releases

• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• lcms2 - Little CMS color management library

Details

Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-10165)

Quang Nguyen discovered that Little CMS incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-16435)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• liblcms2-2 - 2.9-1ubuntu0.1
• liblcms2-utils - 2.9-1ubuntu0.1

Ubuntu 16.04

• liblcms2-2 - 2.6-3ubuntu2.1
• liblcms2-utils - 2.6-3ubuntu2.1

Ubuntu 14.04

• liblcms2-2 - 2.5-0ubuntu4.2
• liblcms2-utils - 2.5-0ubuntu4.2

After a standard system update you need to restart applications using Little
CMS to make all the necessary changes.

References

• CVE-2016-10165
• CVE-2018-16435

Related notices

• USN-3770-2: liblcms2-utils, liblcms-utils, lcms2, lcms, liblcms1, liblcms2-2