bugtraq - [SECURITY] [DSA 4059-1] libxcursor security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 08 Dec 2017 19:40:23 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4059-1] libxcursor security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4059-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
December 08, 2017                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libxcursor
CVE ID         : CVE-2017-16612
Debian Bug     : 883792

It was discovered that libXcursor, a X cursor management library, is
prone to several heap overflows when parsing malicious files. An
attacker can take advantage of these flaws for arbitrary code execution,
if a user is tricked into processing a specially crafted cursor file.

For the oldstable distribution (jessie), these problems have been fixed
in version 1:1.1.14-1+deb8u1.

For the stable distribution (stretch), these problems have been fixed in
version 1:1.1.14-1+deb9u1.

We recommend that you upgrade your libxcursor packages.

For the detailed security status of libxcursor please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/libxcursor

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAloq6oFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QSjA/+JDR6jRLYoUQJvaOyt0B1OgCRMZl8O2pwbuJjP6I9QQkoAJ8JIn2QJNgx
CaRk/DgSlkCqAgHS8GJXMd5qWK2nct4fastz4K4GtyD9VUQt1vtq9mHcitRwvfkg
sTgrcl7cNMQ8u0B6D+JFnYNyVmROe9Kvmly+FceszeFF9Pjql9RRdzCH4OJkh0Zp
GXImCk5Gk46JonznsHot4FtrR4eaLPgC6lmIhRYZg2WZMR5D6gYikhRy3bWM8CCf
Uz8dLSFeMhqPhN/LoEOb4cKPSP2lOEiWFbTCDt1wlokdTp8bOXU7SLFUwjVurKcU
5vvIdWYPezdkAwj0dbWyvkMJo8qmHzLChkxZEb8L9w8LMUIUpYe/XG8N++WOEsvW
1fhTsbOsxCBNp4g+R8d2c8sj1bTxCXgKrWHa4hcoLCi091gtoLEMv63yG+wEUqYu
QeGCJDJNrhz1amuianzrUaRQ9byMUYrdVrg+PjKATOxIdEaaFAGDrk1AFnEb6LQ2
t4U4WYzw0ca/Eyyx8HFCU9MLrpwYOtir5iUwMtMxRAPg2KUUi7g3X4GOXwhB5uHy
E2uqSNbhl+/dOA+2g8CcUAGrVr8rGriyHOTytXt3zKku7H53itbDI6oLoyP2Ip+7
JNKY372psYmfoPlDKsvEdUoaMTPcAZoENr+k7uPVUpsmjIVhdHw=
=Od3E
-----END PGP SIGNATURE-----