CVE-2016-7950
libXrender: Insufficient validation of server responses results out-of-bounds write in XRenderQueryFilters
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Ubuntu (faible).
Description
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | pas de correctif indiqué |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender, libXrender-devel | pas de correctif indiqué |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Afficher les 10 entrées de 9 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libxrender | 1:0.9.10-1 |
| debian 12 | libxrender | 1:0.9.10-1 |
| debian 13 | libxrender | 1:0.9.10-1 |
| debian 14 | libxrender | 1:0.9.10-1 |
| debian 7 | libxrender | 1:0.9.7-1+deb7u3 |
| debian 8 | libxrender | pas de correctif indiqué |
| echo | libxrender | 1:0.9.10-1 |
| Red Hat | libXrender | pas de correctif indiqué |
| Red Hat | libXrender-devel | pas de correctif indiqué |
| ubuntu 16.04-ESM | libxrender | 1:0.9.9-0ubuntu1+esm1 |
Références
- http://www.openwall.com/lists/oss-security/2016/10/04/2
- http://www.openwall.com/lists/oss-security/2016/10/04/4
- http://www.securityfocus.com/bid/93369
- http://www.securitytracker.com/id/1036945
- https://access.redhat.com/security/cve/CVE-2016-7950
- https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=8fad00b0b647ee662ce4737ca15be033b7a21714
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6/