svn commit: r456537 - head/security/vuxml

Sun Dec 17 15:23:52 UTC 2017

Author: zeising
Date: Sun Dec 17 15:23:50 2017
New Revision: 456537
URL: https://svnweb.freebsd.org/changeset/ports/456537

Log:
  Document x11/libXcursor -- integer overflow that can lead to heap buffer
  overflow.
  
  CVE-2017-16612

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sun Dec 17 15:14:49 2017	(r456536)
+++ head/security/vuxml/vuln.xml	Sun Dec 17 15:23:50 2017	(r456537)
@@ -58,6 +58,45 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
+    <topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
+    <affects>
+      <package>
+	<name>libXcursor</name>
+	<range><lt>1.1.15</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The freedesktop.org project reports:</p>
+	<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
+	  <p>It is possible to trigger heap overflows due to an integer
+	    overflow while parsing images and a signedness issue while
+	    parsing comments.</p>
+	  <p>The integer overflow occurs because the chosen limit 0x10000
+	    for dimensions is too large for 32 bit systems, because each pixel
+	    takes 4 bytes. Properly chosen values allow an overflow which in
+	    turn will lead to less allocated memory than needed for subsequent
+	    reads.</p>
+	  <p>The signedness bug is triggered by reading the length of a comment
+	    as unsigned int, but casting it to int when calling the function
+	    XcursorCommentCreate. Turning length into a negative value allows
+	    the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
+	    addition of sizeof (XcursorComment) + 1 makes it possible to
+	    allocate less memory than needed for subsequent reads.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>http://seclists.org/oss-sec/2017/q4/339</url>
+      <url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
+    </references>
+    <dates>
+      <discovery>2017-11-28</discovery>
+      <entry>2017-12-17</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
     <topic>global -- gozilla vulnerability</topic>
     <affects>
