Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libXawUpgrade libXt-develUpgrade libvdpau-develUpgrade vulkan-debuginfoUpgrade mesa-libOSMesa-develUpgrade xkeyboard-config-develUpgrade libXi-debuginfoUpgrade mesa-filesystemUpgrade libxkbcommon-x11Upgrade libxkbcommon-debuginfoUpgrade libXtst-debuginfoUpgrade libICE-debuginfoUpgrade libXvMCUpgrade libXpm-debuginfoUpgrade libXfontUpgrade libepoxy-develUpgrade libXvMC-develUpgrade libwacomUpgrade libXtst-develUpgrade mesa-debuginfoUpgrade libXpmUpgrade libXcursorUpgrade libXtUpgrade mesa-libEGLUpgrade libXfixesUpgrade libX11Upgrade libXxf86vm-develUpgrade vulkan-filesystemUpgrade libXrender-develUpgrade mesa-libOSMesaUpgrade libX11-debuginfoUpgrade mesa-vulkan-driversUpgrade libXrenderUpgrade libevdev-develUpgrade libXaw-debuginfoUpgrade libXfont2-develUpgrade vulkan-develUpgrade libXrandrUpgrade libxkbfile-debuginfoUpgrade mesa-private-llvm-debuginfoUpgrade libdrm-debuginfoUpgrade libepoxy-debuginfoUpgrade xcb-protoUpgrade libdrmUpgrade libX11-commonUpgrade libXt-debuginfoUpgrade mesa-libgbmUpgrade libdrm-develUpgrade libXfont-develUpgrade libICEUpgrade libXxf86vm-debuginfoUpgrade libXvMC-debuginfoUpgrade mesa-libgbm-develUpgrade libwacom-develUpgrade libxkbcommonUpgrade libinput-develUpgrade libvdpau-docsUpgrade libxcb-develUpgrade libxcb-docUpgrade libvdpauUpgrade libevdevUpgrade libXrender-debuginfoUpgrade libevdev-debuginfoUpgrade mesa-libGLES-develUpgrade libwacom-dataUpgrade libX11-develUpgrade mesa-private-llvmUpgrade libXcursor-develUpgrade libXi-develUpgrade libXfixes-develUpgrade libXv-debuginfoUpgrade libXdmcpUpgrade libXdmcp-debuginfoUpgrade mesa-libxatrackerUpgrade libxcb-debuginfoUpgrade libepoxyUpgrade libevdev-utilsUpgrade libXrandr-develUpgrade libXfont-debuginfoUpgrade libXiUpgrade libvdpau-debuginfoUpgrade libfontencUpgrade libxkbfileUpgrade mesa-libGL-develUpgrade mesa-libglapiUpgrade libXaw-develUpgrade xkeyboard-configUpgrade libfontenc-develUpgrade mesa-libGLESUpgrade libxkbcommon-x11-develUpgrade mesa-libEGL-develUpgrade mesa-libGLUpgrade mesa-dri-driversUpgrade vulkanUpgrade libXrandr-debuginfoUpgrade xorg-x11-proto-develUpgrade libxcbUpgrade libXfixes-debuginfoUpgrade libXtstUpgrade libxkbfile-develUpgrade mesa-private-llvm-develUpgrade libinput-debuginfoUpgrade libXfont2Upgrade libxkbcommon-develUpgrade libfontenc-debuginfoUpgrade mesa-libxatracker-develUpgrade libXcursor-debuginfoUpgrade libwacom-debuginfoUpgrade libICE-develUpgrade libXpm-develUpgrade libXxf86vmUpgrade drm-utilsUpgrade libXvUpgrade libXfont2-debuginfoUpgrade libXv-develUpgrade libinputUpgrade libXdmcp-devel | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motifUpgrade motif-devel | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade libxkbcommon-develUpgrade libX11-commonUpgrade mesa-libOSMesa-develUpgrade mesa-private-llvm-develUpgrade libepoxyUpgrade libdrmUpgrade xorg-x11-proto-develUpgrade libxkbfileUpgrade libevdev-utilsUpgrade libXfont-develUpgrade libXpmUpgrade libXcursor-develUpgrade libXvMC-develUpgrade mesa-libxatracker-develUpgrade xkeyboard-configUpgrade libXvUpgrade libxkbcommon-x11Upgrade xkeyboard-config-develUpgrade libICEUpgrade drm-utilsUpgrade mesa-libOSMesaUpgrade libXxf86vmUpgrade mesa-libgbmUpgrade mesa-libgbm-develUpgrade libXaw-develUpgrade libxcb-docUpgrade vulkan-develUpgrade libXcursorUpgrade mesa-libGL-develUpgrade libXrandrUpgrade mesa-vulkan-driversUpgrade mesa-libglapiUpgrade mesa-libEGLUpgrade libXdmcp-develUpgrade mesa-libGLES-develUpgrade libfontenc-develUpgrade libxkbfile-develUpgrade mesa-libEGL-develUpgrade libXpm-develUpgrade libxcbUpgrade mesa-libGLUpgrade libXrenderUpgrade libdrm-develUpgrade libXiUpgrade libXv-develUpgrade libXrandr-develUpgrade libXfixesUpgrade libevdevUpgrade libevdev-develUpgrade libepoxy-develUpgrade libXfont2-develUpgrade libinput-develUpgrade libwacom-develUpgrade libXfontUpgrade libXawUpgrade vulkanUpgrade libXfixes-develUpgrade libinputUpgrade libX11Upgrade mesa-libGLESUpgrade libXtstUpgrade libxkbcommonUpgrade mesa-libxatrackerUpgrade libwacom-dataUpgrade libICE-develUpgrade libvdpau-docsUpgrade mesa-private-llvmUpgrade vulkan-filesystemUpgrade libvdpau-develUpgrade libvdpauUpgrade libxcb-develUpgrade libXxf86vm-develUpgrade libXvMCUpgrade libxkbcommon-x11-develUpgrade libXt-develUpgrade libXdmcpUpgrade libfontencUpgrade libX11-develUpgrade libXtst-develUpgrade xcb-protoUpgrade libXrender-develUpgrade mesa-dri-driversUpgrade libXi-develUpgrade mesa-filesystemUpgrade libwacomUpgrade libXtUpgrade libXfont2 | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libXrenderUpgrade mesa-libgbmUpgrade libXtUpgrade libXv-develUpgrade libXpmUpgrade mesa-libEGLUpgrade vulkan-debuginfoUpgrade libXfontUpgrade libepoxy-develUpgrade libevdevUpgrade libXt-develUpgrade libepoxy-debuginfoUpgrade libX11Upgrade libXrandrUpgrade libXawUpgrade libX11-debuginfoUpgrade libxcbUpgrade libevdev-develUpgrade libxkbfile-debuginfoUpgrade libXxf86vm-debuginfoUpgrade libwacom-develUpgrade mesa-debuginfoUpgrade libxkbcommonUpgrade mesa-libGLESUpgrade libepoxyUpgrade mesa-libEGL-develUpgrade libXfixesUpgrade libxkbcommon-debuginfoUpgrade libXcursorUpgrade libXaw-debuginfoUpgrade libXfont-debuginfoUpgrade libdrm-develUpgrade xkeyboard-config-develUpgrade libICE-debuginfoUpgrade libwacom-debuginfoUpgrade libvdpau-develUpgrade libXpm-debuginfoUpgrade libXvMC-develUpgrade libevdev-utilsUpgrade libXfont-develUpgrade libdrmUpgrade libXt-debuginfoUpgrade libxcb-docUpgrade mesa-private-llvm-debuginfoUpgrade mesa-libGLES-develUpgrade libwacom-dataUpgrade vulkanUpgrade libXi-debuginfoUpgrade mesa-vulkan-driversUpgrade libXvMCUpgrade libICEUpgrade mesa-libGLUpgrade mesa-filesystemUpgrade mesa-libxatrackerUpgrade libXfont2-develUpgrade libXv-debuginfoUpgrade libwacomUpgrade vulkan-develUpgrade mesa-libOSMesaUpgrade libICE-develUpgrade vulkan-filesystemUpgrade libfontenc-debuginfoUpgrade mesa-dri-driversUpgrade libfontencUpgrade libXdmcp-develUpgrade libdrm-debuginfoUpgrade drm-utilsUpgrade libXtstUpgrade libxkbcommon-x11Upgrade libXrandr-debuginfoUpgrade libxcb-develUpgrade libXrandr-develUpgrade libXtst-develUpgrade xorg-x11-proto-develUpgrade libXtst-debuginfoUpgrade libXpm-develUpgrade libXfont2-debuginfoUpgrade libXfixes-debuginfoUpgrade libinput-develUpgrade libXvUpgrade libX11-develUpgrade libvdpau-debuginfoUpgrade libXxf86vmUpgrade libXrender-debuginfoUpgrade mesa-libxatracker-develUpgrade mesa-libOSMesa-develUpgrade libXvMC-debuginfoUpgrade libXiUpgrade mesa-libglapiUpgrade libevdev-debuginfoUpgrade libXfont2Upgrade libXdmcpUpgrade libXdmcp-debuginfoUpgrade libxkbfile-develUpgrade mesa-private-llvm-develUpgrade libfontenc-develUpgrade xkeyboard-configUpgrade libXxf86vm-develUpgrade mesa-libGL-develUpgrade libXcursor-debuginfoUpgrade xcb-protoUpgrade mesa-libgbm-develUpgrade libXfixes-develUpgrade libXaw-develUpgrade libvdpau-docsUpgrade libxkbcommon-x11-develUpgrade libxkbcommon-develUpgrade libXcursor-develUpgrade libXi-develUpgrade mesa-private-llvmUpgrade libinput-debuginfoUpgrade libxcb-debuginfoUpgrade libX11-commonUpgrade libinputUpgrade libvdpauNo solution existsUpgrade libxkbfileUpgrade libXrender-devel | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade xorg-x11-libXpm-develUpgrade xorg-x11-libXpm-x86Upgrade libXpm-toolsUpgrade libXpm-develUpgrade xorg-x11-libXpm-devel-32bitUpgrade libXpm4-32bitUpgrade libXpm4Upgrade xorg-x11-libXpm-32bitUpgrade xorg-x11-libXpm | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub