A buffer overflow when handling DEVICERESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
Systems using an affected libXi version are exposed when they connect to a malicious X server. The attack is network-reachable, but exploitation also requires user interaction.
An attacker needs to operate or control a malicious X server and cause a client using the affected library to process a crafted DEVICE_RESOLUTION response. The vulnerability has high attack complexity and does not require attacker privileges.
Successful exploitation can overflow heap memory and may affect confidentiality, integrity, and availability.
Avoid connecting affected applications to untrusted X servers until libXi is updated to a version that is not affected. The issue affects libXi versions before 1.8.4.