PT-2016-7445 · X.Org+2 · Libxtst+2

Tobias Stoeckmann · Published 2016-10-12 · Updated 2020-11-23 · CVE-2016-7952

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions X.org libXtst versions prior to 1.2.3

Description The issue allows remote X servers to cause a denial of service, resulting in an infinite loop. This can be triggered via a reply in certain categories without a client sequence and with attached data, specifically the XRecordStartOfData, XRecordEndOfData, or XRecordClientDied categories.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to remote X servers to minimize the risk of exploitation.

Fix

DoS

RCE

Improper Access Control

Weakness Enumeration

CWE-20

CWE-284

Related Identifiers

ALT-PU-2020-3326

ALT-PU-2020-3330

ALT-PU-2020-3399

CVE-2016-7952

DLA-686-1

MGASA-2018-0011

SUSE-SU-2016:2505-1

SUSE-SU-2016:2828-1

SUSE-SU-2016:3189-1

Affected Products

Alt Linux

Suse

Libxtst

References · 52

• https://advisories.mageia.org/MGASA-2018-0011.html · Security Note
• https://errata.altlinux.org/ALT-PU-2020-3326 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7952 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-7952 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVEUZRHYY3AJEKMFQ4DS7DX3Y2AICFP7 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3189-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2828-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7952 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7952 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3330 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3399 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFLHX7WNEUXXDAGR324T35L5P6RRR7GE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2505-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7952 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-7952 · Vendor Advisory