CVE-2017-2626 — libICE: weak entropy usage in session keys

Back Back to CVE browser

MEDIUM

libICE: weak entropy usage in session keys

Published Jul 27, 2018

5.5

MEDIUM

CVSS 3.0

EPSS 0.46%

Description

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.

Affected products

Vendor Xorg Product libICE Default
n/a
- Version
  1.0.9-8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xorg

libICE

n/a

Version	Status	Constraints
1.0.9-8	affected	-

Red Hat Enterprise Linux 7

libICE-0:1.0.9-9.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libX11-0:1.6.5-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXaw-0:1.0.13-4.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXcursor-0:1.1.14-8.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXdmcp-0:1.1.2-6.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXfixes-0:5.0.3-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXfont-0:1.5.2-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXfont2-0:2.0.1-2.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXi-0:1.7.9-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXpm-0:3.5.12-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXrandr-0:1.5.1-2.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXrender-0:0.9.10-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXt-0:1.1.5-3.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXtst-0:1.2.3-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXv-0:1.0.11-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXvMC-0:1.0.10-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libXxf86vm-0:1.1.4-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libdrm-0:2.4.74-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libepoxy-0:1.3.1-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libevdev-0:1.5.6-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libfontenc-0:1.1.3-3.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libinput-0:1.6.3-2.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libvdpau-0:1.1.1-3.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libwacom-0:0.24-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libxcb-0:1.12-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libxkbcommon-0:0.7.1-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

libxkbfile-0:1.0.9-3.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

mesa-0:17.0.1-6.20170307.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

mesa-private-llvm-0:3.9.1-3.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

vulkan-0:1.0.39.1-2.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

xcb-proto-0:1.12-2.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

xkeyboard-config-0:2.20-1.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 7

xorg-x11-proto-devel-0:7.7-20.el7

Fixed · RHSA-2017:1865
Red Hat Enterprise Linux 5

libICE

Will not fix
Red Hat Enterprise Linux 6

libICE

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	libICE-0:1.0.9-9.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libX11-0:1.6.5-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXaw-0:1.0.13-4.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXcursor-0:1.1.14-8.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXdmcp-0:1.1.2-6.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXfixes-0:5.0.3-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXfont-0:1.5.2-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXfont2-0:2.0.1-2.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXi-0:1.7.9-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXpm-0:3.5.12-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXrandr-0:1.5.1-2.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXrender-0:0.9.10-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXt-0:1.1.5-3.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXtst-0:1.2.3-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXv-0:1.0.11-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXvMC-0:1.0.10-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libXxf86vm-0:1.1.4-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libdrm-0:2.4.74-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libepoxy-0:1.3.1-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libevdev-0:1.5.6-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libfontenc-0:1.1.3-3.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libinput-0:1.6.3-2.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libvdpau-0:1.1.1-3.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libwacom-0:0.24-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libxcb-0:1.12-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libxkbcommon-0:0.7.1-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	libxkbfile-0:1.0.9-3.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	mesa-0:17.0.1-6.20170307.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	mesa-private-llvm-0:3.9.1-3.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	vulkan-0:1.0.39.1-2.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	xcb-proto-0:1.12-2.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	xkeyboard-config-0:2.20-1.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 7	xorg-x11-proto-devel-0:7.7-20.el7	Fixed	RHSA-2017:1865
Red Hat Enterprise Linux 5	libICE	Will not fix	n/a
Red Hat Enterprise Linux 6	libICE	Will not fix	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

0.46% 0.00460

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00460

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.46% (0.00460)	37.52th	v5 (v2026.06.15)
Jun 15, 2026	0.46% (0.00464)	36.43th	v5 (v2026.06.15)
Mar 17, 2025	0.03% (0.00033)	6.11th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.28% (0.01282)	68.34th	v2 (v2022.01.01)
Feb 4, 2022	1.28% (0.01282)	41.72th	v2 (v2022.01.01)
Feb 3, 2022	1.11% (0.01109)	29.18th	v5 (v2026.06.15)
Apr 14, 2021	1.11% (0.01109)	0.00th	v1

Weaknesses (1)

CWE-331

References (13)

http://www.openwall.com/lists/oss-security/2019/07/14/3
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/96480
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037919
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1865
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-2626
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1424992
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2626
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b
x_refsource_CONFIRMPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00022.html
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2017-2626
https://security.gentoo.org/glsa/201704-03
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-2626
https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
x_refsource_MISCMitigationThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/07/14/3		mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/96480		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037919		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1865		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-2626		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1424992		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2626		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b		x_refsource_CONFIRMPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00022.html		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2017-2626
https://security.gentoo.org/glsa/201704-03		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-2626
https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/		x_refsource_MISCMitigationThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Jul 27, 2018

Updated Aug 5, 2024

Reserved Dec 1, 2016

Link CVE-2017-2626

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-2626

Red Hat

Severity Low

Public date Feb 28, 2017

Links CVE-2017-2626 - Bugzilla