{"id":"CVE-2016-7949","aliases":["BELL-CVE-2016-7949","DEBIAN-CVE-2016-7949","DLA-664-1","EUVD-2016-8798","GHSA-6hhj-qxqj-cvqh","MGASA-2018-0011","SUSE-SU-2016:2505-1","SUSE-SU-2016:2828-1","SUSE-SU-2016:3115-1","UBUNTU-CVE-2016-7949","USN-5436-1"],"status":"published","title":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org...","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03721,"percentile":0.89864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-787"],"published":"2016-10-12T09:36:18Z","modified":"2026-10-20T10:47:59Z","fixes":[{"ecosystem":"Debian:12","package":"libxrender","fixed_in":["1:0.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxrender","fixed_in":["1:0.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxrender","fixed_in":["1:0.9.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxrender","fixed_in":["1:0.9.9-0ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.7-1+deb7u3"}]}],"versions":["1:0.9.7-1","1:0.9.7-1+deb7u1","1:0.9.7-1+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxrandr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-4.1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"libxvmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXrandr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXrandr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXrandr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXrandr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXfixes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXvMC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-1.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-1.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-1.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.8-1","1:0.9.8-1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.9-0ubuntu1+esm1"}]}],"versions":["1:0.9.9-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.9-0ubuntu1+esm1"}]}],"versions":["1:0.9.9-0ubuntu1"],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"x.org","product":"libxrender"}],"references":[{"url":"http://www.securitytracker.com/id/1036945","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201704-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.x.org/archives/xorg-announce/2016-October/002720.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.securityfocus.com/bid/93366","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/04/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/04/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7949"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WCKZFMZ76APAVMIRCUKKHEB4GAS7ZUP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHUT5YOSWVMBJNWZGUQNZRBFIZKRM4A6"},{"url":"https://github.com/advisories/GHSA-6hhj-qxqj-cvqh"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-7949","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7949","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0011.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19530","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/10/04/4","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1002991","tags":["report"]},{"url":"https://bugzilla.suse.com/1002995","tags":["report"]},{"url":"https://bugzilla.suse.com/1002998","tags":["report"]},{"url":"https://bugzilla.suse.com/1003000","tags":["report"]},{"url":"https://bugzilla.suse.com/1003002","tags":["report"]},{"url":"https://bugzilla.suse.com/1003012","tags":["report"]},{"url":"https://bugzilla.suse.com/1003017","tags":["report"]},{"url":"https://bugzilla.suse.com/1003023","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7953","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162828-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163115-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7949","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5436-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7950","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7949","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:00:00Z","modified":"2024-08-06T02:13:21.128Z","updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2016-8798","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:00:00Z","modified":"2024-08-06T02:13:21Z","updated_at":"2026-11-03T02:22:31.485682Z"}],"ghsa":[{"id":"GHSA-6hhj-qxqj-cvqh","title":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org...","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2022-05-17T02:37:03Z","modified":"2025-04-12T13:08:26Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:30.991417Z"}],"nvd":[{"id":"CVE-2016-7949","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:59:15.583Z","modified":"2026-06-17T00:53:48.643Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-787"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"BELL-CVE-2016-7949","title":"CVE-2016-7949 does not affect BellSoft software","status":"withdrawn","published":"2016-12-13T20:59:00Z","modified":"2026-01-26T09:49:05.874923Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-7949","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:59:15.583Z","modified":"2026-10-20T10:47:59.983372964Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-7949","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:59:15.583Z","modified":"2026-09-22T07:02:34.110406328Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7949","description":"Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.","status":"published","published":"2016-12-13T20:59:00Z","modified":"2026-04-22T10:59:31.557727Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-664-1","title":"libxrender - security update","status":"published","published":"2016-10-18T00:00:00Z","modified":"2026-03-09T02:10:11.635726Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2018-0011","title":"Updated X11 client libraries packages fix security vulnerability","description":"The XvQueryAdaptors and XvQueryEncodings functions in X.org libXv before\n1.0.11 allow remote X servers to trigger out-of-bounds memory access\noperations via vectors involving length specifications in received data\n(CVE-2016-5407).\n\nThe XGetImage function in X.org libX11 before 1.6.4 might allow remote X\nservers to gain privileges via vectors involving image type and geometry,\nwhich triggers out-of-bounds read operations (CVE-2016-7942).\n\nThe XListFonts function in X.org libX11 before 1.6.4 might allow remote X\nservers to gain privileges via vectors involving length fields, which\ntrigger out-of-bounds write operations (CVE-2016-7943).\n\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might\nallow remote X servers to gain privileges via a length value of INT_MAX,\nwhich triggers the client to stop reading data and get out of sync\n(CVE-2016-7944).\n\nMultiple integer overflows in X.org libXi before 1.7.7 allow remote X\nservers to cause a denial of service (out-of-bounds memory access or\ninfinite loop) via vectors involving length fields (CVE-2016-7945).\n\nX.org libXi before 1.7.7 allows remote X servers to cause a denial of\nservice (infinite loop) via vectors involving length fields\n(CVE-2016-7946).\n\nMultiple integer overflows in X.org libXrandr before 1.5.1 allow remote X\nservers to trigger out-of-bounds write operations via a crafted response\n(CVE-2016-7947).\n\nX.org libXrandr before 1.5.1 allows remote X servers to trigger\nout-of-bounds write operations by leveraging mishandling of reply data\n(CVE-2016-7948).\n\nMultiple buffer overflows in the XvQueryAdaptors and XvQueryEncodings\nfunctions in X.org libXrender before 0.9.10 allow remote X servers to\ntrigger out-of-bounds write operations via vectors involving length fields\n(CVE-2016-7949).\n\nThe XRenderQueryFilters function in X.org libXrender before 0.9.10 allows\nremote X servers to trigger out-of-bounds write operations via vectors\ninvolving filter name lengths (CVE-2016-7950).\n\nMultiple integer overflows in X.org libXtst before 1.2.3 allow remote X\nservers to trigger out-of-bounds memory access operations by leveraging\nthe lack of range checks (CVE-2016-7951).\n\nX.org libXtst before 1.2.3 allows remote X servers to cause a denial of\nservice (infinite loop) via a reply in the XRecordStartOfData,\nXRecordEndOfData, or XRecordClientDied category without a client sequence\nand with attached data (CVE-2016-7952).\n\nBuffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to\nhave unspecified impact via an empty string (CVE-2016-7953).\n","status":"published","published":"2018-01-01T15:50:28Z","modified":"2026-04-16T06:25:22.394917606Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2016:2505-1","title":"Security update for X Window System client libraries","description":"This update for the X Window System client libraries fixes a class of privilege escalation issues.\n\nA malicious X Server could send specially crafted data to X clients, which allowed for triggering crashes, or privilege escalation if this relationship was untrusted or crossed user or permission level boundaries.\n\nlibX11, libXfixes, libXi, libXrandr, libXrender, libXtst, libXv, libXvMC were fixed, specifically:\n\nlibX11:\n- CVE-2016-7942: insufficient validation of data from the X server allowed out of boundary memory read (bsc#1002991)\n\nlibXfixes:\n- CVE-2016-7944: insufficient validation of data from the X server can cause an integer overflow on 32 bit architectures (bsc#1002995)\n\nlibXi:\n- CVE-2016-7945, CVE-2016-7946: insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service) (bsc#1002998)\n\nlibXtst:\n- CVE-2016-7951, CVE-2016-7952: insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service) (bsc#1003012)\n\nlibXv:\n- CVE-2016-5407: insufficient validation of data from the X server can cause out of boundary memory and memory corruption (bsc#1003017)\n\nlibXvMC:\n- CVE-2016-7953: insufficient validation of data from the X server can cause a one byte buffer read underrun (bsc#1003023)\n\nlibXrender:\n- CVE-2016-7949, CVE-2016-7950: insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003002)\n\nlibXrandr:\n- CVE-2016-7947, CVE-2016-7948: insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003000)\n","status":"published","published":"2016-10-12T09:36:18Z","modified":"2026-02-04T03:03:23.952748Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2828-1","title":"Security update for X Window System client libraries","description":"\nThis update for the X Window System client libraries fixes a class of privilege escalation issues.\n\nA malicious X Server could send specially crafted data to X clients, which allowed for triggering\ncrashes, or privilege escalation if this relationship was untrusted or crossed user or permission\nlevel boundaries.\n\nlibX11, libXfixes, libXi, libXrandr, libXrender, libXtst, libXv, libXvMC were fixed, specifically:\n\nlibX11:\n- CVE-2016-7942: insufficient validation of data from the X server allowed out of boundary memory\n  read (bsc#1002991)\n\nlibXfixes:\n- CVE-2016-7944: insufficient validation of data from the X server can cause an integer overflow\n  on 32 bit architectures (bsc#1002995)\n\nlibXi:\n- CVE-2016-7945, CVE-2016-7946: insufficient validation of data from the X server can cause out of\n  boundary memory access or endless loops (Denial of Service) (bsc#1002998)\n\nlibXtst:\n- CVE-2016-7951, CVE-2016-7952: insufficient validation of data from the X server can cause out of\n  boundary memory access or endless loops (Denial of Service) (bsc#1003012)\n\nlibXv:\n- CVE-2016-5407: insufficient validation of data from the X server can cause out of boundary memory\n  and memory corruption (bsc#1003017)\n\nlibXvMC:\n- CVE-2016-7953: insufficient validation of data from the X server can cause a one byte buffer read\n  underrun (bsc#1003023)\n\nlibXrender:\n- CVE-2016-7949, CVE-2016-7950: insufficient validation of data from the X server can cause out of\n  boundary memory writes (bsc#1003002)\n\nlibXrandr:\n- CVE-2016-7947, CVE-2016-7948: insufficient validation of data from the X server can cause out of\n  boundary memory writes (bsc#1003000)\n","status":"published","published":"2016-11-17T13:34:57Z","modified":"2026-02-04T02:53:30.908437Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3115-1","title":"Security update for xorg-x11-libXrender","description":"\nThis update for xorg-x11-libXrender fixes the following issues:\n\n  - insufficient validation of data from the X server can cause out\n    of boundary memory writes (bsc#1003002, CVE-2016-7949, CVE-2016-7950)\n","status":"published","published":"2016-12-13T11:54:51Z","modified":"2026-02-04T02:15:58.649603Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-5436-1","title":"libxrender vulnerabilities","description":"Tobias Stoeckmann discovered that libXrender incorrectly handled certain\nresponses. An attacker could possibly use this issue to cause a denial\nof service, or possibly execute arbitrary code.\n(CVE-2016-7949, CVE-2016-7950)\n","status":"published","published":"2022-05-23T18:04:37Z","modified":"2026-06-25T13:31:12.104639495Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}