ISOMAN

CVE

CVE-2017-16612

libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://security.cucumberlinux.com/security/details.php?id=156
  2. http://www.openwall.com/lists/oss-security/2017/11/28/6
  3. http://www.ubuntu.com/usn/USN-3501-1
  4. https://bugzilla.suse.com/show_bug.cgi?id=1065386
  5. https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38
  6. https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
  7. https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html
  8. https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html
  9. https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2
  10. https://security.gentoo.org/glsa/201801-04
  11. https://usn.ubuntu.com/3622-1/
  12. https://www.debian.org/security/2017/dsa-4059
  13. http://security.cucumberlinux.com/security/details.php?id=156
  14. http://www.openwall.com/lists/oss-security/2017/11/28/6
  15. http://www.ubuntu.com/usn/USN-3501-1
  16. https://bugzilla.suse.com/show_bug.cgi?id=1065386
  17. https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38
  18. https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
  19. https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html
  20. https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html