CVEvulnerability
CVE-2017-16612
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-12-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-190
Description
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.
Affected configurations
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.04
• canonical ubuntu linux 17.10
• x libxcursor (<= 1.1.14)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- http://security.cucumberlinux.com/security/details.php?id=156 Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/11/28/6 Mailing List, Third Party Advisory
- http://www.ubuntu.com/usn/USN-3501-1 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1065386 Issue Tracking, Tool Signature, VDB Entry
- https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38 cgit.freedesktop.org
- https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html lists.debian.org
- https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html lists.freedesktop.org
- https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2 Third Party Advisory
- https://security.gentoo.org/glsa/201801-04 security.gentoo.org
- https://usn.ubuntu.com/3622-1/ usn.ubuntu.com
- https://www.debian.org/security/2017/dsa-4059 Third Party Advisory
- http://security.cucumberlinux.com/security/details.php?id=156 Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/11/28/6 Mailing List, Third Party Advisory
- http://www.ubuntu.com/usn/USN-3501-1 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1065386 Issue Tracking, Tool Signature, VDB Entry
- https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38 cgit.freedesktop.org
- https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html lists.debian.org
- https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html lists.freedesktop.org
- https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2 Third Party Advisory
- https://security.gentoo.org/glsa/201801-04 security.gentoo.org
- https://usn.ubuntu.com/3622-1/ usn.ubuntu.com
- https://www.debian.org/security/2017/dsa-4059 Third Party Advisory