Bug 1381928 (CVE-2016-7950) - CVE-2016-7950 libXrender: Insufficient validation of server responses results out-of-bounds write in XRenderQueryFilters
Summary: CVE-2016-7950 libXrender: Insufficient validation of server responses results...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2016-7950
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1381930
Blocks: 1381939
TreeView+ depends on / blocked
 
Reported: 2016-10-05 11:34 UTC by Andrej Nemec
Modified: 2019-09-29 13:57 UTC (History)
4 users (show)

Fixed In Version: libXrender 0.9.10
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:59:40 UTC


Attachments (Terms of Use)

Description Andrej Nemec 2016-10-05 11:34:23 UTC
It was found that when receiving a response from the server protocol data is not validated sufficiently. The memory for filter names is reserved right after receiving the reply. After that, filters are iterated and each individual filter name is stored in that reserved memory. The individual name lengths are not checked for validity, which means that a malicious server can reserve less memory than it will write to during each iteration.

Upstream patch:

https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=8fad00b0b647ee662ce4737ca15be033b7a21714

External References:

https://lists.x.org/archives/xorg-announce/2016-October/002720.html

CVE assignment:

http://seclists.org/oss-sec/2016/q4/17

Comment 1 Andrej Nemec 2016-10-05 11:35:02 UTC
Created libXrender tracking bugs for this issue:

Affects: fedora-all [bug 1381930]


Note You need to log in before you can comment on or make changes to this bug.