CVE-2017-16612 libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vec...
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxcursor(Debian:12) | < 1:1.1.14-3.1 | 1:1.1.14-3.1 |
| debian/libxcursor(Debian:13) | < 1:1.1.14-3.1 | 1:1.1.14-3.1 |
| debian/libxcursor(Debian:14) | < 1:1.1.14-3.1 | 1:1.1.14-3.1 |
| debian/wayland(Debian:12) | < 1.14.0-2 | 1.14.0-2 |
| debian/wayland(Debian:13) | < 1.14.0-2 | 1.14.0-2 |
| debian/wayland(Debian:14) | < 1.14.0-2 | 1.14.0-2 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| x libxcursor | <= 1.1.14 | No fix listed |
| alpine/libxcursor(Alpine:v3.10) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.11) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.12) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.13) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.14) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.15) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.16) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.17) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.18) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.19) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.20) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.21) | < 1.1.15-r0 | 1.1.15-r0 |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libxcursor(Alpine:v3.22) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.23) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.24) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.4) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.5) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.6) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.7) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.8) | < 1.1.15-r0 | 1.1.15-r0 |
| alpine/libxcursor(Alpine:v3.9) | < 1.1.15-r0 | 1.1.15-r0 |
References
- Debian Security Tracker CVE-2017-16612 vendor-advisory
- security.cucumberlinux.com patch third-party-advisory
- [oss-security] 20171128 CVE-2017-16612 libXcursor: heap overflows when parsing malicious files mailing-list third-party-advisory
- USN-3501-1 third-party-advisory vendor-advisory
- bugzilla.suse.com issue-tracking tool-signature vdb-entry
- cgit.freedesktop.org
- cgit.freedesktop.org exploit patch third-party-advisory
- [debian-lts-announce] 20171210 [SECURITY] [DLA 1201-1] libxcursor security update mailing-list
- lists.freedesktop.org
- [freedesktop-xorg-announce] 20171128 libXcursor 1.1.15 mailing-list third-party-advisory
- GLSA-201801-04 vendor-advisory
- USN-3622-1 vendor-advisory
- DSA-4059 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking