[arch-security] [ASA-201711-41] libxcursor: arbitrary code execution

[Levente Polyak]

Arch Linux Security Advisory ASA-201711-41
==========================================

Severity: High
Date    : 2017-11-30
CVE-ID  : CVE-2017-16612
Package : libxcursor
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-531

Summary
=======

The package libxcursor before version 1.1.15-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.1.15-1.

# pacman -Syu "libxcursor>=1.1.15-1"

The problem has been fixed upstream in version 1.1.15.

Workaround
==========

None.

Description
===========

It was discovered that libxcursor before 1.1.15 is vulnerable to heap
overflows due to an integer overflow while parsing images and a
signedness issue while parsing comments. An attacker could use local
privileges or trick a user into parsing a malicious file to cause
libxcursor to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Impact
======

An attacker could use local privileges or trick a user into parsing a
malicious image file to cause libxcursor to crash, resulting in a
denial of service, or possibly execute arbitrary code.

References
==========

http://openwall.com/lists/oss-security/2017/11/28/6
https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2
https://security.archlinux.org/CVE-2017-16612

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 866 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171201/fdbe4c51/attachment-0001.asc>