CVE-2017-2626: Medium severity libice development libraries vulnerability
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.
Other sources
It was found that libICE depends on a weak entropy mechanism, possibly allowing attackers to attach to the session of a different user.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2626?
The severity of CVE-2017-2626 is considered moderate as it allows a local attacker to hijack sessions due to weak key generation.
How do I fix CVE-2017-2626?
To fix CVE-2017-2626, you should upgrade libICE to version 1.0.9-8 or later.
Which software is affected by CVE-2017-2626?
CVE-2017-2626 affects libICE versions before 1.0.9-8 as well as specific versions of Red Hat Enterprise Linux.
What types of attacks can be conducted due to CVE-2017-2626?
CVE-2017-2626 can potentially allow local attackers to perform session hijacking.
Is CVE-2017-2626 exploitable remotely?
CVE-2017-2626 is not exploitable remotely, as it requires local access to the system.