CVE-2016-10165

What it actually does

Out-of-bounds heap read in the Type_MLU_Read function triggered by a crafted ICC color profile, resulting in sensitive information disclosure or denial of service.

Why it matters to the business

Attackers could leak sensitive data or crash affected services; the flaw has been public for nearly a decade with a known fix available, so continued exposure increases long-term operational risk and compliance concerns.

How an attack unfolds

An attacker crafts an image containing a malicious ICC profile and supplies it to an application using the vulnerable Little CMS library; when the profile is parsed, the Type_MLU_Read function performs an out-of-bounds heap read that may expose memory contents or cause a crash.

How to fix it

Upgrade phpmyadmin/phpmyadmin to the commit 25b8da6488338e44fd238abccf4e626119116898 or later; if the library is used directly, update Little CMS (lcms2) to a version containing the equivalent fix.

How to confirm the fix worked

Confirm the installed commit hash or library version matches or exceeds the fixed revision; test with a known-malicious ICC profile to verify the out-of-bounds read no longer occurs.

Typical attack path

1. Identify an application entry point that accepts user-supplied images or ICC profiles
2. Generate a malicious ICC profile that triggers the out-of-bounds read in Type_MLU_Read
3. Deliver the crafted image to the target application
4. Observe either leaked memory contents in responses or application/service crash

How to detect it

Review application and system logs for crashes or abnormal memory access patterns when processing image uploads; examine any historic crash dumps or core files that reference cmstypes.c or ICC profile parsing around the time of suspected activity.

What your security team should do

• Immediately update all instances to the fixed commit 25b8da6488338e44fd238abccf4e626119116898
• Scan codebases and container images for any remaining copies of the vulnerable cmstypes.c implementation
• Add automated dependency checks to prevent reintroduction of the old lcms2 code