High severity · published Dec 1, 2017
CVE-2017-16612
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP
7.5
CVSS
5.2%
EPSS
No
On KEV
Description
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
LI
Libxcursor · X
through 1.1.14 · source: NVD
UL
Ubuntu Linux · Canonical
14.04; 16.04; 17.04; 17.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-16612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-16612
Patch
http://security.cucumberlinux.com/security/details.php?id=156
Mailing List
http://www.openwall.com/lists/oss-security/2017/11/28/6
Third Party Advisory
http://www.ubuntu.com/usn/USN-3501-1
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1065386
cgit.freedesktop.org
https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38
Exploit
https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation