Summary
It was discovered that libXtst did not properly handle certain RECORD
replies from the X server. A malicious X server could possibly use this
issue to cause libXtst clients to crash, resulting in a denial of service.
(CVE-2026-94286)
Tobias Stoeckmann discovered that libXtst did not properly handle certain
memory operations. A malicious X server could possibly use this issue to
cause libXtst to access memory out of bounds, resulting in a denial of
service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7951)
Tobias Stoeckmann discovered that libXtst did not properly handle certain
replies from the X server. A malicious X server could possibly use this
issue to cause libXtst to enter an infinite loop, resulting in a denial of
service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7952)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libxtst | 2:1.2.3-1ubuntu0.22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | libxtst | 2:1.2.3-1.1ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libxtst | 2:1.2.5-1ubuntu0.1 |
| Ubuntu · 26.10 | libxtst | 2:1.2.5-1ubuntu1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxtst | 2:1.2.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxtst | 2:1.2.3-1ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxtst | 2:1.2.3-1ubuntu0.20.04.1~esm1 |
Vulnerabilities 3
-
High 7.1
Out-of-bounds read in libXtst's RECORD reply parser
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
-
Unscored —
Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access …
-
Unscored —
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) …