Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libXtstUpgrade libXrandr-debuginfoUpgrade libICE-develUpgrade libXfont-debuginfoUpgrade libxcb-docUpgrade libwacom-dataUpgrade mesa-libGLESUpgrade libfontencUpgrade libvdpau-debuginfoUpgrade mesa-libglapiUpgrade libXiUpgrade libxkbfileUpgrade libvdpau-docsUpgrade libXvUpgrade libinput-debuginfoUpgrade libxcb-develUpgrade mesa-libEGL-develUpgrade mesa-dri-driversUpgrade libxkbcommon-x11-develUpgrade libXfixes-debuginfoUpgrade libxkbfile-develUpgrade mesa-libGLUpgrade libXcursor-develUpgrade xorg-x11-proto-develUpgrade libX11-develUpgrade libevdev-debuginfoUpgrade mesa-libGLES-develUpgrade mesa-libxatracker-develUpgrade libinput-develUpgrade libXrandr-develUpgrade mesa-libxatrackerUpgrade libxkbcommon-develUpgrade vulkanUpgrade libwacom-debuginfoUpgrade libXcursor-debuginfoUpgrade libvdpauUpgrade libXdmcp-debuginfoUpgrade libinputUpgrade libxcb-debuginfoUpgrade libxcbUpgrade libepoxyUpgrade mesa-libGL-develUpgrade libXfont2Upgrade drm-utilsUpgrade libXfixes-develUpgrade libXi-develUpgrade libevdev-utilsUpgrade mesa-private-llvm-develUpgrade libfontenc-debuginfoUpgrade mesa-private-llvmUpgrade libXpm-develUpgrade libXdmcp-develUpgrade libfontenc-develUpgrade libXfont2-debuginfoUpgrade libXxf86vmUpgrade libXrender-debuginfoUpgrade libXaw-develUpgrade libevdevUpgrade libXv-develUpgrade libXdmcpUpgrade xkeyboard-configUpgrade libXv-debuginfoUpgrade libxkbcommonUpgrade libXxf86vm-debuginfoUpgrade mesa-libOSMesaUpgrade libvdpau-develUpgrade libXrenderUpgrade libXt-develUpgrade libX11-debuginfoUpgrade mesa-vulkan-driversUpgrade libXfont-develUpgrade mesa-private-llvm-debuginfoUpgrade libXcursorUpgrade libXvMC-develUpgrade libXtUpgrade libxkbfile-debuginfoUpgrade libICEUpgrade libXxf86vm-develUpgrade libXaw-debuginfoUpgrade libXvMC-debuginfoUpgrade libwacom-develUpgrade libXawUpgrade libXvMCUpgrade libdrm-debuginfoUpgrade xkeyboard-config-develUpgrade libXrender-develUpgrade libX11Upgrade mesa-debuginfoUpgrade libdrmUpgrade vulkan-develUpgrade xcb-protoUpgrade libXtst-develUpgrade vulkan-filesystemUpgrade libXfixesUpgrade libdrm-develUpgrade libXpmUpgrade mesa-libEGLUpgrade libICE-debuginfoUpgrade libXrandrUpgrade vulkan-debuginfoUpgrade mesa-libOSMesa-develUpgrade libXpm-debuginfoUpgrade mesa-libgbmUpgrade libXi-debuginfoUpgrade libepoxy-debuginfoUpgrade libevdev-develUpgrade libxkbcommon-x11Upgrade libepoxy-develUpgrade libXfontUpgrade libxkbcommon-debuginfoUpgrade libXtst-debuginfoUpgrade libX11-commonUpgrade mesa-filesystemUpgrade libwacomUpgrade mesa-libgbm-develUpgrade libXfont2-develUpgrade libXt-debuginfo | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motifUpgrade motif-devel | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade mesa-libgbm-develUpgrade mesa-libGLES-develUpgrade libXvMC-develUpgrade libXdmcp-develUpgrade mesa-vulkan-driversUpgrade libX11-commonUpgrade libXpm-develUpgrade libXiUpgrade libxkbfileUpgrade libxkbcommon-x11Upgrade mesa-libGL-develUpgrade libxkbfile-develUpgrade xorg-x11-proto-develUpgrade libXrandr-develUpgrade mesa-libxatracker-develUpgrade libXvUpgrade libxkbcommon-develUpgrade libdrmUpgrade libXcursorUpgrade libXrandrUpgrade libXv-develUpgrade libepoxyUpgrade libfontenc-develUpgrade mesa-libOSMesa-develUpgrade vulkan-develUpgrade libICEUpgrade libepoxy-develUpgrade libevdev-utilsUpgrade libXfixesUpgrade drm-utilsUpgrade mesa-libEGLUpgrade mesa-libglapiUpgrade libXpmUpgrade libXcursor-develUpgrade libXfont-develUpgrade mesa-private-llvm-develUpgrade libevdevUpgrade libXaw-develUpgrade mesa-libEGL-develUpgrade libXrenderUpgrade xkeyboard-configUpgrade libevdev-develUpgrade libXfont2-develUpgrade libxcb-docUpgrade libdrm-develUpgrade libxcbUpgrade mesa-libgbmUpgrade mesa-libGLUpgrade libXxf86vmUpgrade mesa-libOSMesaUpgrade xkeyboard-config-develUpgrade libfontencUpgrade libXdmcpUpgrade libXrender-develUpgrade libXtst-develUpgrade libXfont2Upgrade vulkanUpgrade libwacomUpgrade libinputUpgrade libvdpau-develUpgrade libXfontUpgrade libXtUpgrade libICE-develUpgrade libvdpau-docsUpgrade mesa-dri-driversUpgrade libX11-develUpgrade libvdpauUpgrade libXvMCUpgrade libxcb-develUpgrade libXfixes-develUpgrade libXawUpgrade libwacom-develUpgrade libxkbcommon-x11-develUpgrade libXxf86vm-develUpgrade libXt-develUpgrade libX11Upgrade libinput-develUpgrade libxkbcommonUpgrade libwacom-dataUpgrade mesa-libxatrackerUpgrade vulkan-filesystemUpgrade mesa-libGLESUpgrade libXtstUpgrade libXi-develUpgrade xcb-protoUpgrade mesa-filesystemUpgrade mesa-private-llvm | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libXxf86vmUpgrade mesa-private-llvmUpgrade libxkbcommon-x11Upgrade libXrender-debuginfoUpgrade mesa-libxatracker-develUpgrade libvdpau-debuginfoUpgrade libXvUpgrade libXtst-debuginfoUpgrade xcb-protoUpgrade libxkbcommon-x11-develUpgrade libXaw-develUpgrade libXrender-develUpgrade libXtstUpgrade mesa-libGL-develUpgrade libXdmcpUpgrade libXrandr-develUpgrade libxkbfile-develUpgrade libxcb-debuginfoUpgrade libvdpauUpgrade libinput-develUpgrade libinputUpgrade libXfont2No solution existsUpgrade libXxf86vm-develUpgrade libXiUpgrade libxkbfileUpgrade libXi-develUpgrade libXfixes-develUpgrade mesa-libgbm-develUpgrade mesa-libOSMesa-develUpgrade libXcursor-debuginfoUpgrade libXfont2-debuginfoUpgrade mesa-libglapiUpgrade libXrandr-debuginfoUpgrade libXdmcp-debuginfoUpgrade libX11-develUpgrade libXdmcp-develUpgrade libvdpau-docsUpgrade xorg-x11-proto-develUpgrade libXcursor-develUpgrade libfontenc-develUpgrade libdrm-debuginfoUpgrade mesa-private-llvm-develUpgrade libXtst-develUpgrade drm-utilsUpgrade libxkbcommon-develUpgrade libinput-debuginfoUpgrade libXpm-develUpgrade mesa-dri-driversUpgrade libevdev-debuginfoUpgrade libX11-commonUpgrade libXvMC-debuginfoUpgrade libfontencUpgrade xkeyboard-configUpgrade libxcb-develUpgrade libXfixes-debuginfoUpgrade libXrenderUpgrade libvdpau-develUpgrade libdrmUpgrade libXfont-develUpgrade mesa-vulkan-driversUpgrade libXxf86vm-debuginfoUpgrade libXaw-debuginfoUpgrade libXrandrUpgrade libfontenc-debuginfoUpgrade libxkbcommon-debuginfoUpgrade libevdev-develUpgrade libwacom-debuginfoUpgrade libX11-debuginfoUpgrade libICE-develUpgrade libevdev-utilsUpgrade vulkan-debuginfoUpgrade libwacom-dataUpgrade libXvMCUpgrade vulkanUpgrade mesa-filesystemUpgrade libwacom-develUpgrade libXpm-debuginfoUpgrade libXtUpgrade mesa-libxatrackerUpgrade libxcb-docUpgrade libdrm-develUpgrade libwacomUpgrade xkeyboard-config-develUpgrade libXt-develUpgrade libXcursorUpgrade libXt-debuginfoUpgrade libXpmUpgrade libxcbUpgrade mesa-libEGLUpgrade libevdevUpgrade mesa-private-llvm-debuginfoUpgrade libXv-debuginfoUpgrade mesa-libEGL-develUpgrade libICE-debuginfoUpgrade libxkbcommonUpgrade libXi-debuginfoUpgrade mesa-libOSMesaUpgrade libepoxy-debuginfoUpgrade libXawUpgrade mesa-libGLUpgrade libXfontUpgrade libXv-develUpgrade mesa-libGLESUpgrade libX11Upgrade libxkbfile-debuginfoUpgrade vulkan-develUpgrade libepoxy-develUpgrade mesa-libGLES-develUpgrade libXvMC-develUpgrade libXfixesUpgrade libepoxyUpgrade libXfont2-develUpgrade mesa-libgbmUpgrade vulkan-filesystemUpgrade libXfont-debuginfoUpgrade mesa-debuginfoUpgrade libICE | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade libXpm4Upgrade xorg-x11-libXpmUpgrade libXpm4-32bitUpgrade xorg-x11-libXpm-32bitUpgrade xorg-x11-libXpm-devel-32bitUpgrade libXpm-toolsUpgrade xorg-x11-libXpm-x86Upgrade libXpm-develUpgrade xorg-x11-libXpm-devel | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub