CVE-2016-7942 Memory corruption in n/a
A remote X server can gain privileges by triggering out-of-bounds reads in the XGetImage function of the libX11 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7942?
CVE-2016-7942 is a critical memory corruption vulnerability in Fedoraproject Fedora, published on 13 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.
Which versions are affected by CVE-2016-7942?
It affects 2 products.
Linux distribution packages (12)
libX11 SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 1.6.2-11.1 |
libX11 SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.6.2-11.1 |
xorg-x11-libX11 SUSE:Linux Enterprise Server 11 SP4 | All versions | 7.4-5.11.65.1 |
libX11 SUSE:Linux Enterprise Server 12 SP1 | All versions | 1.6.2-11.1 |
libX11 SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.6.2-11.1 |
libX11 SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.6.2-11.1 |
xorg-x11-libX11 SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 7.4-5.11.65.1 |
libX11 SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.6.2-11.1 |
libX11 SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.6.2-11.1 |
xorg-x11-libX11 SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 7.4-5.11.65.1 |
libX11 SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 1.6.2-11.1 |
libX11 SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.6.2-11.1 |
Products include Fedoraproject Fedora, X.org Libx11.
How do I fix CVE-2016-7942?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-7942 being exploited?
There is no known exploitation of CVE-2016-7942 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2016-7942, DEBIAN-CVE-2016-7942, GHSA-22xc-96jv-r6q2, SUSE-SU-2016:3001-1, SUSE-SU-2016:3054-1, UBUNTU-CVE-2016-7942.