{"id":"CVE-2017-16612","aliases":["ALPINE-CVE-2017-16612","BELL-CVE-2017-16612","DEBIAN-CVE-2017-16612","DLA-1201-1","DSA-4059-1","EUVD-2017-7803","GHSA-777r-cpw4-3m4v","MGASA-2017-0443","SUSE-SU-2017:3214-1","SUSE-SU-2018:0246-1","UBUNTU-CVE-2017-16612","USN-3501-1","USN-3622-1","openSUSE-SU-2024:10919-1"],"status":"published","title":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows...","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05173,"percentile":0.92502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2017-11-28T00:00:00Z","modified":"2026-10-20T10:48:18Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libxcursor","fixed_in":["1.1.15-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxcursor","fixed_in":["1:1.1.14-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxcursor","fixed_in":["1:1.1.14-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxcursor","fixed_in":["1:1.1.14-3.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wayland","fixed_in":["1.14.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wayland","fixed_in":["1.14.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wayland","fixed_in":["1.14.0-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libxcursor","fixed_in":["1:1.1.13-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libxcursor","fixed_in":["1:1.1.14-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libxcursor","fixed_in":["1:1.1.14-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libxcursor","fixed_in":["1.1.14-5.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"libxcursor","fixed_in":["1.1.14-6.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libXcursor","fixed_in":["1.1.14-4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxcursor","fixed_in":["1:1.1.14-1ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wayland","fixed_in":["1.4.0-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxcursor","fixed_in":["1:1.1.14-1ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wayland","fixed_in":["1.12.0-1~ubuntu16.04.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libXcursor","fixed_in":["1.2.0-1.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.13-1+deb7u2"}]}],"versions":["1:1.1.13-1","1:1.1.13-1+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1+deb8u1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Debian:9","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1+deb9u1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Mageia:5","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-5.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-6.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.50.5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.50.5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.50.5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1ubuntu0.14.04.1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1ubuntu1.1"}]}],"versions":["1.1.0-2ubuntu3","1.3.0-1","1.3.92-1","1.4.0-1","1.4.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1ubuntu0.16.04.1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1~ubuntu16.04.3"}]}],"versions":["1.8.1-1","1.9.0-1","1.12.0-1~ubuntu16.04.1","1.12.0-1~ubuntu16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1ubuntu0.14.04.1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.14-1ubuntu0.16.04.1"}]}],"versions":["1:1.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1ubuntu1.1"}]}],"versions":["1.1.0-2ubuntu3","1.3.0-1","1.3.92-1","1.4.0-1","1.4.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1~ubuntu16.04.3"}]}],"versions":["1.8.1-1","1.9.0-1","1.12.0-1~ubuntu16.04.1","1.12.0-1~ubuntu16.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXcursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.9"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"x","product":"libxcursor"}],"references":[{"url":"https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3622-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2017/11/28/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1065386","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Tool Signature","VDB Entry","report"]},{"url":"https://security.gentoo.org/glsa/201801-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3501-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://marc.info/?l=freedesktop-xorg-announce\u0026m=151188036018262\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://security.cucumberlinux.com/security/details.php?id=156","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2017/dsa-4059","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16612"},{"url":"https://usn.ubuntu.com/3622-1"},{"url":"https://github.com/advisories/GHSA-777r-cpw4-3m4v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-16612","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-16612","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16612","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0443.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22102","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3501-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16612","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1049692","tags":["report"]},{"url":"https://bugzilla.suse.com/1050459","tags":["report"]},{"url":"https://bugzilla.suse.com/1054285","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13722","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16612","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3501-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3622-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16612","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:00:00Z","modified":"2024-08-05T20:27:04.328Z","updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-7803","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:00:00Z","modified":"2024-08-05T20:27:04Z","updated_at":"2026-11-03T02:23:11.972603Z"}],"ghsa":[{"id":"GHSA-777r-cpw4-3m4v","title":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows...","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2022-05-14T03:32:29Z","modified":"2025-04-20T03:50:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:56.679657Z"}],"nvd":[{"id":"CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:29:00.51Z","modified":"2026-06-17T01:09:34.103Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"ALPINE-CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:29:00.51Z","modified":"2026-06-15T18:18:06.775760262Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-16612","title":"CVE-2017-16612 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:32.882151Z","modified":"2026-01-26T09:46:40.704372Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:29:00.51Z","modified":"2026-10-20T10:48:18.03532348Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-12-01T17:29:00.51Z","modified":"2026-09-01T20:03:45.348569071Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-16612","description":"libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.","status":"published","published":"2017-11-28T00:00:00Z","modified":"2026-04-22T11:19:20.200753Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1201-1","title":"libxcursor - security update","status":"published","published":"2017-12-10T00:00:00Z","modified":"2026-03-09T01:01:36.379768Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4059-1","title":"libxcursor - security update","status":"published","published":"2017-12-08T00:00:00Z","modified":"2026-03-09T01:17:46.093057Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0443","title":"Updated libxcursor packages fix security vulnerability","description":"Heap overflows when parsing malicious files. (CVE-2017-16612)\n","status":"published","published":"2017-12-06T11:43:08Z","modified":"2026-04-16T06:25:26.048657716Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10919-1","title":"libXcursor-devel-1.2.0-1.9 on GA media","description":"These are all security issues fixed in the libXcursor-devel-1.2.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:31.657102Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:3214-1","title":"Security update for libXcursor","description":"This update for libXcursor fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16612: Fix integeroverflow while parsing images and a signedness issue while parsing comments (bsc#1065386).\n","status":"published","published":"2017-12-05T16:39:22Z","modified":"2026-02-04T03:23:39.682552Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:0246-1","title":"Security update for xorg-x11-libs","description":"This update for xorg-x11-libs fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-16612: Heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments (bsc#1065386).\n- CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285)\n- CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692)\n- Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459)\n","status":"published","published":"2018-01-26T16:41:13Z","modified":"2026-02-04T02:49:29.816459Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3501-1","title":"libxcursor vulnerability","description":"It was discovered that libxcursor incorrectly handled certain files. An\nattacker could use these issues to cause libxcursor to crash, resulting in\na denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2017-11-29T18:06:23Z","modified":"2026-04-22T09:42:03.036681Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3622-1","title":"wayland vulnerability","description":"It was discovered that the Wayland Xcursor support incorrectly handled\ncertain files. An attacker could use these issues to cause Wayland to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2018-04-09T16:42:29Z","modified":"2026-04-22T09:44:57.126839Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}