Arch Linux Security Advisory ASA-201711-42 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-16612 Package : lib32-libxcursor Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-532 Summary ======= The package lib32-libxcursor before version 1.1.15-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.15-1. # pacman -Syu "lib32-libxcursor>=1.1.15-1" The problem has been fixed upstream in version 1.1.15. Workaround ========== None. Description =========== It was discovered that libxcursor before 1.1.15 is vulnerable to heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments. An attacker could use local privileges or trick a user into parsing a malicious file to cause libxcursor to crash, resulting in a denial of service, or possibly execute arbitrary code. Impact ====== An attacker could use local privileges or trick a user into parsing a malicious image file to cause libxcursor to crash, resulting in a denial of service, or possibly execute arbitrary code. References ========== http://openwall.com/lists/oss-security/2017/11/28/6 https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158... https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2 https://security.archlinux.org/CVE-2017-16612