It was found that libICE depends on a weak entropy mechanism, possibly allowing attackers to attach to the session of a different user.
Acknowledgments: Name: Eric Sesterhenn (X41 D-Sec GmbH)
Adjusted CVSS scoring and reduced impact to Low based on requiring the attacker needing to be logged in locally, and ICE's only visible use in RHEL being XSMP session managers, whose disruption is of limited impact.
Created libICE tracking bugs for this issue: Affects: fedora-all [bug 1427715]
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Original reporter's advisory: https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ Upstream commit: https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:1865 https://access.redhat.com/errata/RHSA-2017:1865