CVE-2016-7950
libXrender: Insufficient validation of server responses results out-of-bounds write in XRenderQueryFilters
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | kein Fix angegeben |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender, libXrender-devel | kein Fix angegeben |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Alle 10 Einträge aus 9 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | kein Fix angegeben |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender | kein Fix angegeben |
| Red Hat | libXrender-devel | kein Fix angegeben |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Referenzen
- http://www.openwall.com/lists/oss-security/2016/10/04/2
- http://www.openwall.com/lists/oss-security/2016/10/04/4
- http://www.securityfocus.com/bid/93369
- http://www.securitytracker.com/id/1036945
- https://access.redhat.com/security/cve/CVE-2016-7950
- https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=8fad00b0b647ee662ce4737ca15be033b7a21714
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6/