Vulnerability Details : CVE-2016-7952
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.
Vulnerability category: Input validationBypassGain privilegeDenial of service
Products affected by CVE-2016-7952
- cpe:2.3:a:x.org:libxtst:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7952
0.98%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7952
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-7952
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-7952
-
https://lists.x.org/archives/xorg-announce/2016-October/002720.html
X.Org security advisory: Protocol handling issues in X Window System client librariesVendor Advisory
-
https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3
xorg/lib/libXtst - X.org libXtst library. (mirrored from https://gitlab.freedesktop.org/xorg/lib/libxtst)Issue Tracking;Patch
-
http://www.securitytracker.com/id/1036945
X Client Library Bugs Let Remote and Local Users Deny Service or Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFLHX7WNEUXXDAGR324T35L5P6RRR7GE/
[SECURITY] Fedora 24 Update: libXtst-1.2.3-1.fc24 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RVEUZRHYY3AJEKMFQ4DS7DX3Y2AICFP7/
[SECURITY] Fedora 25 Update: libXtst-1.2.3-1.fc25 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2016/10/04/4
oss-security - Re: X.Org security advisory: Protocol handling issues in X Window System client librariesMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/93375
X.Org libXtst CVE-2016-7952 Multiple Unspecified Security VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2016/10/04/2
oss-security - X.Org security advisory: Protocol handling issues in X Window System client librariesMailing List;Third Party Advisory
Jump to