[arch-security] [ASA-201711-41] libxcursor: arbitrary code execution
anthraxx at archlinux.org
Fri Dec 1 20:27:28 UTC 2017
Arch Linux Security Advisory ASA-201711-41
Date : 2017-11-30
CVE-ID : CVE-2017-16612
Package : libxcursor
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-531
The package libxcursor before version 1.1.15-1 is vulnerable to
arbitrary code execution.
Upgrade to 1.1.15-1.
# pacman -Syu "libxcursor>=1.1.15-1"
The problem has been fixed upstream in version 1.1.15.
It was discovered that libxcursor before 1.1.15 is vulnerable to heap
overflows due to an integer overflow while parsing images and a
signedness issue while parsing comments. An attacker could use local
privileges or trick a user into parsing a malicious file to cause
libxcursor to crash, resulting in a denial of service, or possibly
execute arbitrary code.
An attacker could use local privileges or trick a user into parsing a
malicious image file to cause libxcursor to crash, resulting in a
denial of service, or possibly execute arbitrary code.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 866 bytes
Desc: OpenPGP digital signature
More information about the arch-security