CVE catalog

CVE-2017-16612

libxcursor: CVE-2017-16612

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.17% · Oct 25, 2026

libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwaylandsid1.26.0-1fixed
Debianwaylandforky1.26.0-1fixed
Debianwaylandtrixie1.23.1-3fixed
Debianwaylandbookworm1.21.0-1fixed
Debianlibxcursorsid1:1.2.3-1fixed
Debianlibxcursorforky1:1.2.3-1fixed
Debianlibxcursortrixie1:1.2.3-1fixed
Debianlibxcursorbookworm1:1.2.1-1fixed
Alpinelibxcursor3.101.1.15-r0fixed
Alpinelibxcursor3.111.1.15-r0fixed
Alpinelibxcursor3.121.1.15-r0fixed
Alpinelibxcursor3.131.1.15-r0fixed
Alpinelibxcursor3.141.1.15-r0fixed
Alpinelibxcursor3.151.1.15-r0fixed
Alpinelibxcursor3.161.1.15-r0fixed
Alpinelibxcursor3.171.1.15-r0fixed
Alpinelibxcursor3.181.1.15-r0fixed
Alpinelibxcursor3.191.1.15-r0fixed
Alpinelibxcursor3.201.1.15-r0fixed
Alpinelibxcursor3.211.1.15-r0fixed
Alpinelibxcursor3.221.1.15-r0fixed
Alpinelibxcursor3.231.1.15-r0fixed
Alpinelibxcursor3.241.1.15-r0fixed
Alpinelibxcursor3.41.1.15-r0fixed
Alpinelibxcursor3.51.1.15-r0fixed
Alpinelibxcursor3.61.1.15-r0fixed
Alpinelibxcursor3.71.1.15-r0fixed
Alpinelibxcursor3.81.1.15-r0fixed
Alpinelibxcursor3.91.1.15-r0fixed
Ubuntulibxcursor14.041:1.1.14-1vulnerable
Ubuntulibxcursor14.041:1.1.14-1ubuntu0.14.04.1fixed
Ubuntuwayland14.041.1.0-2ubuntu3vulnerable
Ubuntuwayland14.041.3.0-1vulnerable
Ubuntuwayland14.041.3.92-1vulnerable
Ubuntuwayland14.041.4.0-1vulnerable
Ubuntuwayland14.041.4.0-1ubuntu1vulnerable
Ubuntuwayland14.041.4.0-1ubuntu1.1fixed
Ubuntulibxcursor16.041:1.1.14-1vulnerable
Ubuntulibxcursor16.041:1.1.14-1ubuntu0.16.04.1fixed
Ubuntuwayland16.041.8.1-1vulnerable
Ubuntuwayland16.041.9.0-1vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.1vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.2vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.3fixed
Ubuntuwayland14.041.1.0-2ubuntu3vulnerable
Ubuntuwayland14.041.3.0-1vulnerable
Ubuntuwayland14.041.3.92-1vulnerable
Ubuntuwayland14.041.4.0-1vulnerable
Ubuntuwayland14.041.4.0-1ubuntu1vulnerable
Ubuntuwayland14.041.4.0-1ubuntu1.1fixed
Ubuntuwayland16.041.8.1-1vulnerable
Ubuntuwayland16.041.9.0-1vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.1vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.2vulnerable
Ubuntuwayland16.041.12.0-1~ubuntu16.04.3fixed
Ubuntulibxcursor14.041:1.1.14-1vulnerable
Ubuntulibxcursor14.041:1.1.14-1ubuntu0.14.04.1fixed
Ubuntulibxcursor16.041:1.1.14-1vulnerable
Ubuntulibxcursor16.041:1.1.14-1ubuntu0.16.04.1fixed
SuselibXcursorlinux enterprise desktop 12 sp21.1.14-4.3.1fixed
SuselibXcursorlinux enterprise desktop 12 sp31.1.14-4.3.1fixed
SuselibXcursorlinux enterprise server for raspberry pi 12 sp21.1.14-4.3.1fixed
SuselibXcursorlinux enterprise software development kit 12 sp21.1.14-4.3.1fixed
SuselibXcursorlinux enterprise software development kit 12 sp31.1.14-4.3.1fixed
SuselibXcursorlinux enterprise server 12 sp21.1.14-4.3.1fixed
SuselibXcursorlinux enterprise server for sap applications 12 sp21.1.14-4.3.1fixed
SuselibXcursorlinux enterprise server 12 sp31.1.14-4.3.1fixed
SuselibXcursorlinux enterprise server for sap applications 12 sp31.1.14-4.3.1fixed
OpensuselibXcursortumbleweed1.2.0-1.9fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwaylandsourcesid1.14.0-2not yet assignedNot reported[889681]
Debianwaylandsourceforky1.14.0-2not yet assignedNot reported[889681]
Debianwaylandsourcetrixie1.14.0-2not yet assignedNot reported[889681]
Debianwaylandsourcebookworm1.14.0-2not yet assignedNot reported[889681]
Debianlibxcursorsourcesid1:1.1.14-3.1not yet assignedNot reported[883792]
Debianlibxcursorsourceforky1:1.1.14-3.1not yet assignedNot reported[883792]
Debianlibxcursorsourcetrixie1:1.1.14-3.1not yet assignedNot reported[883792]
Debianlibxcursorsourcebookworm1:1.1.14-3.1not yet assignedNot reported[883792]
Alpinelibxcursorapk3.101.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.111.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.121.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.131.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.141.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.151.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.161.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.171.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.181.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.191.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.201.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.211.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.221.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.231.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.241.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.41.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.51.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.61.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.71.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.81.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Alpinelibxcursorapk3.91.1.15-r0Not reportedALPINE-CVE-2017-16612Not reported
Ubuntulibxcursordeb14.041:1.1.14-1ubuntu0.14.04.1Not reportedUBUNTU-CVE-2017-16612Not reported
Ubuntuwaylanddeb14.041.4.0-1ubuntu1.1Not reportedUBUNTU-CVE-2017-16612Not reported
Ubuntulibxcursordeb16.041:1.1.14-1ubuntu0.16.04.1Not reportedUBUNTU-CVE-2017-16612Not reported
Ubuntuwaylanddeb16.041.12.0-1~ubuntu16.04.3Not reportedUBUNTU-CVE-2017-16612Not reported
Ubuntuwaylanddeb14.041.4.0-1ubuntu1.1Not reportedUSN-3622-1Not reported
Ubuntuwaylanddeb16.041.12.0-1~ubuntu16.04.3Not reportedUSN-3622-1Not reported
Ubuntulibxcursordeb14.041:1.1.14-1ubuntu0.14.04.1Not reportedUSN-3501-1Not reported
Ubuntulibxcursordeb16.041:1.1.14-1ubuntu0.16.04.1Not reportedUSN-3501-1Not reported
SuselibXcursorrpmlinux enterprise desktop 12 sp21.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise desktop 12 sp31.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise server for raspberry pi 12 sp21.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise software development kit 12 sp21.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise software development kit 12 sp31.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise server 12 sp21.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise server for sap applications 12 sp21.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise server 12 sp31.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
SuselibXcursorrpmlinux enterprise server for sap applications 12 sp31.1.14-4.3.1Not reportedSUSE-SU-2017:3214-1Not reported
OpensuselibXcursorrpmtumbleweed1.2.0-1.9Not reportedOPENSUSE-SU-2024:10919-1Not reported

[Debian bug #889681][Debian bug #883792]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libXcursor1]Unknown

    Source package: [libXcursor]

    Details (1)
    • 1.2.3-1.7 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.0-1.9

      Version impact unknown

      dsa · libXcursor · opensuse · tumbleweed

  • Source package: [libXcursor]

    Details (1)
    • 1.2.3-1.7 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.0-1.9

      Version impact unknown

      dsa · libXcursor · opensuse · tumbleweed

  • Source package: [libXcursor]

    Details (1)
    • 1.2.3-1.7 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.0-1.9

      Version impact unknown

      dsa · libXcursor · opensuse · tumbleweed

  • Source package: [libXcursor]

    Details (1)
    • 1.2.3-1.7 · x86_64 · tumbleweed

      Unknown · Fixed: 1.2.0-1.9

      Version impact unknown

      dsa · libXcursor · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · all · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · all · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [wayland]

    Details (4)
    • 1.21.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.21.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

    • 1.23.0-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · bookworm; dsa · wayland · debian · 12

  • Source package: [libxcursor]

    Details (2)
    • 1:1.2.1-1 · amd64 · bookworm

      Fixed · Fixed: 1:1.1.14-3.1

      dsa · libxcursor · debian · bookworm; dsa · libxcursor · debian · 12

    • 1:1.2.1-1 · arm64 · bookworm

      Fixed · Fixed: 1:1.1.14-3.1

      dsa · libxcursor · debian · bookworm; dsa · libxcursor · debian · 12

  • Source package: [libxcursor]

    Details (2)
    • 1:1.2.1-1 · amd64 · bookworm

      Fixed · Fixed: 1:1.1.14-3.1

      dsa · libxcursor · debian · bookworm; dsa · libxcursor · debian · 12

    • 1:1.2.1-1 · arm64 · bookworm

      Fixed · Fixed: 1:1.1.14-3.1

      dsa · libxcursor · debian · bookworm; dsa · libxcursor · debian · 12

[Debian 13 (Trixie)]

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · amd64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · arm64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · amd64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · arm64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · amd64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · arm64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · amd64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · arm64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · all · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · all · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

  • Source package: [wayland]

    Details (2)
    • 1.23.1-3 · amd64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

    • 1.23.1-3 · arm64 · trixie

      Fixed · Fixed: 1.14.0-2

      dsa · wayland · debian · 13

Next results

Observed:

References