{"schemaVersion":3,"id":"CVE-2016-7944","aliases":["ALPINE-CVE-2016-7944","SUSE-SU-2016:3172-1","UBUNTU-CVE-2016-7944","USN-5437-1","DEBIAN-CVE-2016-7944","DLA-654-1"],"status":"published","duplicateOf":null,"title":null,"description":"Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.","dates":{"published":"2016-12-13T20:00:00.000Z","modified":"2024-08-06T02:13:21.517Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Alpine","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Debian","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.03395,"percentile":0.88673,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03395},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03281,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03395,"percentile":0.88673}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03281,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03395,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03395,"percentile":0.88673}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"},{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"}],"affected":[{"vendor":"alpine","product":"libxfixes","name":"libxfixes","label":"libxfixes","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/libxfixes","purlType":"apk","versions":[{"text":"< 5.0.1-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.0.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.1-r1 | < 5.0.1-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"libxfixes","name":"libxfixes","label":"libxfixes","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libxfixes","purlType":"deb","versions":[{"text":"< 1:5.0.3-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:5.0-4+deb7u2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:5.0.3-1 | < 1:5.0-4+deb7u2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libxfixes","name":"libxfixes","label":"libxfixes","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libxfixes","purlType":"deb","versions":[{"text":"< 1:5.0.3-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:5.0.1-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:5.0.3-1 | < 1:5.0.1-2ubuntu0.1~esm1","eol":null,"hubHref":null},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"24","noFixRecorded":false,"fixedIn":null},{"text":"25","noFixRecorded":false,"fixedIn":null}],"versionsText":"24 | 25","eol":{"isEol":true,"eolDate":"2017-08-08T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"24","label":"24","eolFrom":"2017-08-08T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"suse","product":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server 11 SP4","name":"xorg-x11-libXfixes","label":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server 11 SP4","purlType":"rpm","versions":[{"text":"< 7.4-1.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4-1.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","name":"xorg-x11-libXfixes","label":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xorg-x11-libXfixes&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","purlType":"rpm","versions":[{"text":"< 7.4-1.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4-1.20.1","eol":null,"hubHref":null},{"vendor":"suse","product":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","name":"xorg-x11-libXfixes","label":"xorg-x11-libXfixes&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xorg-x11-libXfixes&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","purlType":"rpm","versions":[{"text":"< 7.4-1.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4-1.20.1","eol":null,"hubHref":null},{"vendor":"x.org","product":"libxfixes","name":"libxfixes","label":"libxfixes","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.0.2","eol":null,"hubHref":"/vendor/xorg/libxfixes"}],"affectedCount":8,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.securitytracker.com/id/1036945","label":"www.securitytracker.com/id/1036945","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://www.securityfocus.com/bid/93361","label":"www.securityfocus.com/bid/93361","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"https://security.gentoo.org/glsa/201704-03","label":"security.gentoo.org/glsa/201704-03","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"https://lists.x.org/archives/xorg-announce/2016-October/002720.html","label":"lists.x.org/archives/xorg-announce/2016-October/002720.html","hostname":"lists.x.org","tags":["Mailing List","X Refsource MLIST","REPORT"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GE43MDCRGS4R7MRRZNVSLREHRLU5OHCV/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/04/4","label":"www.openwall.com/lists/oss-security/2016/10/04/4","hostname":"www.openwall.com","tags":["Mailing List","X Refsource MLIST","REPORT"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CE6VJWBMOWLSCH4OP4TAEPIA7NP53ON/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/04/2","label":"www.openwall.com/lists/oss-security/2016/10/04/2","hostname":"www.openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e","label":"cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e","hostname":"cgit.freedesktop.org","tags":["X Refsource CONFIRM"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-7944","label":"security.alpinelinux.org/vuln/CVE-2016-7944","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163172-1/","label":"www.suse.com/support/update/announcement/2016/suse-su-20163172-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1002995","label":"bugzilla.suse.com/1002995","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7944","label":"www.suse.com/security/cve/CVE-2016-7944","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2016-7944","label":"ubuntu.com/security/CVE-2016-7944","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5437-1","label":"ubuntu.com/security/notices/USN-5437-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7944","label":"www.cve.org/CVERecord?id=CVE-2016-7944","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7944","label":"security-tracker.debian.org/tracker/CVE-2016-7944","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["MGASA-2018-0011","SUSE-SU-2016:2505-1","SUSE-SU-2016:2828-1"],"duplicates":[],"related":["SUSE-SU-2016:2505-1","SUSE-SU-2016:2828-1"]},"timeline":[{"kind":"published","date":"2016-12-13T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T02:13:21.517Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:01:41.940Z","stale":false,"partial":false}}