CVE-2016-7949
libXrender: Insufficient validation of server responses results in overflow of previously reserved memory
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Ubuntu (faible).
Description
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | pas de correctif indiqué |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender, libXrender-devel | pas de correctif indiqué |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Afficher les 10 entrées de 9 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | pas de correctif indiqué |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender | pas de correctif indiqué |
| Red Hat | libXrender-devel | pas de correctif indiqué |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Références
- http://www.openwall.com/lists/oss-security/2016/10/04/2
- http://www.openwall.com/lists/oss-security/2016/10/04/4
- http://www.securityfocus.com/bid/93366
- http://www.securitytracker.com/id/1036945
- https://access.redhat.com/security/cve/CVE-2016-7949
- https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6/