[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE-2017-16612 libXcursor: heap overflows when parsing malicious files
From: Matthieu Herrb <matthieu.herrb () laas ! fr>
Date: 2017-11-28 14:52:26
Message-ID: 20171128145226.GH6762 () timmy ! laas ! fr
[Download RAW message or body]
Hi,
X.Org has just release libXcursor version 1.1.15 which contains the
following security fix:
Author: Tobias Stoeckmann <tobias@stoeckmann.org>
AuthorDate: Sat Oct 21 23:47:52 2017 +0200
Commit: Matthieu Herrb <matthieu@herrb.eu>
CommitDate: Sat Nov 25 11:52:34 2017 +0100
Fix heap overflows when parsing malicious files. (CVE-2017-16612)
It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes
4 bytes. Properly chosen values allow an overflow which in turn will
lead to less allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.
https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2
--
Matthieu Herrb
["signature.asc" (application/pgp-signature)]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic