CVE-2017-2626 It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the proce...
MediumCVSS 5.5
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libice(Debian:12) | < 2:1.0.9-2 | 2:1.0.9-2 |
| debian/libice(Debian:13) | < 2:1.0.9-2 | 2:1.0.9-2 |
| debian/libice(Debian:14) | < 2:1.0.9-2 | 2:1.0.9-2 |
| freedesktop libice | <= 1.0.9 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/libice(Alpine:v3.11) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.12) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.13) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.14) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.15) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.16) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.17) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.18) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.19) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.20) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.21) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.22) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.23) | < 1.0.10-r0 | 1.0.10-r0 |
| alpine/libice(Alpine:v3.24) | < 1.0.10-r0 | 1.0.10-r0 |
| xorg libICE | = 1.0.9-8 | No fix listed |
References
- Debian Security Tracker CVE-2017-2626 vendor-advisory
- [oss-security] 20190714 Fwd: [ANNOUNCE] libICE 1.0.10 mailing-list
- 96480 third-party-advisory vdb-entry
- 1037919 third-party-advisory vdb-entry
- RHSA-2017:1865 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- cgit.freedesktop.org patch vendor-advisory
- [debian-lts-announce] 20191123 [SECURITY] [DLA 2002-1] libice security update mailing-list
- GLSA-201704-03 third-party-advisory vendor-advisory
- www.x41-dsec.de mitigation third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking