What’s Vulnerable › Vulnerabilities

CVE-2017-2626

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-27 · updated 2026-06-17
• Weakness: CWE-331

Description

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.

Affected products

• Freedesktop Libice: through 1.0.9
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.4
• RedHat Enterprise Linux Server Eus: 7.4, 7.5
• RedHat Enterprise Linux Workstation: 7.0

References

• http://www.openwall.com/lists/oss-security/2019/07/14/3
• http://www.securityfocus.com/bid/96480
• http://www.securitytracker.com/id/1037919
• https://access.redhat.com/errata/RHSA-2017:1865
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2626
• https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b
• https://lists.debian.org/debian-lts-announce/2019/11/msg00022.html
• https://security.gentoo.org/glsa/201704-03
• https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
• http://www.openwall.com/lists/oss-security/2019/07/14/3
• http://www.securityfocus.com/bid/96480
• http://www.securitytracker.com/id/1037919

Get alerted when CVE-2017-2626 or the next vulnerability affects your stack