Gentoo update for X.Org

1) Buffer overflow

EUVDB-ID: #VU32237

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5407

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU32226

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7942

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU32227

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7943

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU32228

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7944

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU32229

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7945

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU32230

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7946

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Integer overflow

EUVDB-ID: #VU32231

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7947

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU32232

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7948

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU32233

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7949

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds write

EUVDB-ID: #VU32234

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7950

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU32238

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7953

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information disclosure

EUVDB-ID: #VU36813

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2624

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Key management errors

EUVDB-ID: #VU32096

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2625

CWE-ID: CWE-320 - Key Management Errors

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Insufficient Entropy

EUVDB-ID: #VU32017

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2626

CWE-ID: CWE-331 - Insufficient Entropy

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.

Mitigation

Update the affected packages.
x11-base/xorg-server to version: 1.19.2
x11-libs/libICE to version: 1.0.9-r1
x11-libs/libXdmcp to version: 1.1.2-r1
x11-libs/libXrender to version: 0.9.10
x11-libs/libXi to version: 1.7.7
x11-libs/libXrandr to version: 1.5.1
x11-libs/libXfixes to version: 5.0.3
x11-libs/libXv to version: 1.0.11

Vulnerable software versions

Gentoo Linux: All versions

External links

http://security.gentoo.org/
http://security.gentoo.org/glsa/201704-03

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.