This update for lcms2 fixes the following security issues:
CVE-2016-10165: The TypeMLURead function allowed remote attackers to obtain
sensitive information or cause a denial of service via an image with a crafted
ICC profile, which triggered an out-of-bounds heap read (bsc#1021364).
CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet
function in cmscgats.c, that could lead to a heap-based buffer overflow
in the SetData function via a crafted file in the second argument to
cmsIT8LoadFromFile. (bsc#1108813)
Ensure that LUT stages match channel count (bsc#1026649).
sanitize input and output channels on MPE profiles (bsc#1026650).