Integer overflow in libxrandr - CVE-2016-7947

Vulnerability identifier: #VU32231

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7947

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.

libxrandr
Gentoo Linux
Slackware Linux
Ubuntu
Fedora
libxrandr (Alpine package)
libxrandr2 (Ubuntu package)
libXrandr

Install update from vendor's website.

libxrandr - update to 1.5.1
libxrandr (Alpine package) - update to 1.5.0-r1
libxrandr2 (Ubuntu package) - update to 2:1.5.01ubuntu0.1~esm1
libXrandr - addressed in versions 1.5.1-1.fc23, 1.5.1-1.fc24, 1.5.1-1.fc25

• http://www.openwall.com/lists/oss-security/2016/10/04/2
• http://www.openwall.com/lists/oss-security/2016/10/04/4
• http://www.securityfocus.com/bid/93365
• http://www.securitytracker.com/id/1036945
• https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74FFOHWYIKQZTJLRJWDMJ4W3WYBELUUG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y7662OZWCSTLRPKS6R3E4Y4M26BSVAAM/
• https://lists.x.org/archives/xorg-announce/2016-October/002720.html
• https://security.gentoo.org/glsa/201704-03

• Integer overflow in xorg.freedesktop libxrandr
• Integer overflow in libxrandr (Alpine package)
• Gentoo update for X.Org
• Slackware Linux update for x11
• Ubuntu update for libxrandr
• Fedora 25 update for libXrandr
• Fedora 24 update for libXrandr
• Fedora 23 update for libXrandr