CVE-2016-7952

HIGH 7.5CVE-2016-7952 · Published 13/12/2016 · updated 17/06/2026

In short

CVE-2016-7952 is a HIGH (CVSS 7.5) vulnerability affecting libxtst (x.org).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libxtst x.org	`≤ 1.2.2`	No fix yet

Description

X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.

References

openwall.com/lists/oss-security/2016/10/04/2
openwall.com/lists/oss-security/2016/10/04/4
securityfocus.com/bid/93375
securitytracker.com/id/1036945
cgit.freedesktop.org/xorg/lib/libXtst/commit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFLHX7WNEUXXDAGR324T35L5P6RRR7GE
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVEUZRHYY3AJEKMFQ4DS7DX3Y2AICFP7
lists.x.org/archives/xorg-announce/2016-October/002720.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free