The remote host is affected by the vulnerability described in GLSA-201704-03 (X.Org: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org server and       libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A local or remote users can utilize the vulnerabilities to attach to the       X.Org session as a user and execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for xorg-x11-libICE fixes the following issues :

  - CVE-2017-2626: Creation of the ICE auth session cookies     used insufficient randomness, making these cookies     predictable. A more random generation method has been     implemented. (boo#1025068)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libICE fixes the following issues :

  - CVE-2017-2626: Creation of the ICE auth session cookies     used insufficient randomness, making these cookies     predictable. A more random generation method has been     implemented. (boo#1025068)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It has been found, that libice, an X11 Inter-Client Exchange library, uses weak entropy to generate keys.

Using arc4random_buf() from libbsd should avoid this flaw.

For Debian 8 'Jessie', this problem has been fixed in version 2:1.0.9-1+deb8u1.

We recommend that you upgrade your libice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libICE package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was discovered that libICE used a weak entropy to     generate keys. A local attacker could potentially use     this flaw for session hijacking using the information     available from the process list.(CVE-2017-2626)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99276	GLSA-201704-03 : X.Org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/4/11	2025/12/26	critical
101519	SUSE SLES11 Security Update : xorg-x11-libICE (SUSE-SU-2017:1848-1)	Nessus	SuSE Local Security Checks	2017/7/13	2025/12/11	medium
106578	SUSE SLED12 / SLES12 Security Update : libICE (SUSE-SU-2018:0337-1)	Nessus	SuSE Local Security Checks	2018/2/2	2025/10/30	medium
131247	Debian DLA-2002-1 : libice security update	Nessus	Debian Local Security Checks	2019/11/25	2024/4/10	medium
140940	EulerOS Virtualization for ARM 64 3.0.6.0 : libICE (EulerOS-SA-2020-1992)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/19	medium

检测

插件搜索

critical

medium

medium

medium

medium