CVE-2016-7942
Ubuntu Security Notice USN-3758-2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.
La función XGetImage en X.org libX11 en versiones anteriores a 1.6.4 podría permitir a servidores remotos X obtener privilegios a través de vectores que involucran tipo de imagen y geometría, que desencadena operaciones de lectura fuera de límites.
Tobias Stoeckmann discovered that libx11 incorrectly handled certain images. An attacker could possibly use this issue to access sensitive information Tobias Stoeckmann discovered that libx11 incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. It was discovered that libx11 incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-09-09 CVE Reserved
- 2016-11-01 CVE Published
- 2024-08-06 CVE Updated
- 2025-07-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-787: Out-of-bounds Write
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/10/04/2 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/10/04/4 | Mailing List |
|
| http://www.securityfocus.com/bid/93363 | Vdb Entry | |
| http://www.securitytracker.com/id/1036945 | Vdb Entry | |
| https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17 | X_refsource_confirm | |
| https://lists.x.org/archives/xorg-announce/2016-October/002720.html | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7 | 2023-11-07 | |
| https://security.gentoo.org/glsa/201704-03 | 2023-11-07 | |
| https://usn.ubuntu.com/3758-1 | 2023-11-07 | |
| https://usn.ubuntu.com/3758-2 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 25 Search vendor "Fedoraproject" for product "Fedora" and version "25" | - |
Affected
| ||||||
| X.org Search vendor "X.org" | Libx11 Search vendor "X.org" for product "Libx11" | <= 1.6.3 Search vendor "X.org" for product "Libx11" and version " <= 1.6.3" | - |
Affected
| ||||||