Subject: [ASA-201711-41] libxcursor: arbitrary code execution

Arch Linux Security Advisory ASA-201711-41
==========================================

Severity: High
Date    : 2017-11-30
CVE-ID  : CVE-2017-16612
Package : libxcursor
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-531

Summary
=======

The package libxcursor before version 1.1.15-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.1.15-1.

# pacman -Syu "libxcursor>=1.1.15-1"

The problem has been fixed upstream in version 1.1.15.

Workaround
==========

None.

Description
===========

It was discovered that libxcursor before 1.1.15 is vulnerable to heap
overflows due to an integer overflow while parsing images and a
signedness issue while parsing comments. An attacker could use local
privileges or trick a user into parsing a malicious file to cause
libxcursor to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Impact
======

An attacker could use local privileges or trick a user into parsing a
malicious image file to cause libxcursor to crash, resulting in a
denial of service, or possibly execute arbitrary code.

References
==========

http://openwall.com/lists/oss-security/2017/11/28/6
https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8
https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2
https://security.archlinux.org/CVE-2017-16612