Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libepoxyUpgrade mesa-libGLUpgrade libXv-debuginfoUpgrade libXv-develUpgrade libinputUpgrade libXvUpgrade libxkbfile-develUpgrade libX11-develUpgrade libXdmcp-develUpgrade libXfixes-develUpgrade libxcb-debuginfoUpgrade libXxf86vmUpgrade mesa-private-llvm-develUpgrade libxkbcommon-x11-develUpgrade libXiUpgrade mesa-dri-driversUpgrade libXfont2Upgrade libfontenc-develUpgrade mesa-libxatracker-develUpgrade mesa-libGL-develUpgrade mesa-private-llvmUpgrade libXpm-develUpgrade libXaw-develUpgrade libXi-develUpgrade mesa-libEGL-develUpgrade libwacom-debuginfoUpgrade libevdev-debuginfoUpgrade libfontenc-debuginfoUpgrade libvdpauUpgrade libevdev-utilsUpgrade libwacom-dataUpgrade libXrandr-debuginfoUpgrade libXcursor-debuginfoUpgrade libXdmcpUpgrade mesa-libGLES-develUpgrade libXrandr-develUpgrade libXfont2-debuginfoUpgrade libICE-develUpgrade libinput-develUpgrade xkeyboard-configUpgrade libXcursor-develUpgrade libXfont-debuginfoUpgrade vulkanUpgrade libevdevUpgrade libxcbUpgrade libXtstUpgrade libxkbcommon-develUpgrade mesa-libglapiUpgrade libXfixes-debuginfoUpgrade libxkbfileUpgrade drm-utilsUpgrade libXrender-debuginfoUpgrade mesa-libGLESUpgrade xorg-x11-proto-develUpgrade libinput-debuginfoUpgrade libvdpau-docsUpgrade libxcb-develUpgrade mesa-libxatrackerUpgrade libXdmcp-debuginfoUpgrade libvdpau-debuginfoUpgrade libxcb-docUpgrade libfontencUpgrade mesa-libOSMesaUpgrade libxkbfile-debuginfoUpgrade libXtst-debuginfoUpgrade xkeyboard-config-develUpgrade libXvMCUpgrade libXtUpgrade mesa-private-llvm-debuginfoUpgrade libICEUpgrade libdrm-debuginfoUpgrade libXaw-debuginfoUpgrade libXvMC-debuginfoUpgrade libXrender-develUpgrade libXxf86vm-debuginfoUpgrade vulkan-filesystemUpgrade libX11-commonUpgrade libXxf86vm-develUpgrade libX11Upgrade libXrenderUpgrade libwacom-develUpgrade mesa-libgbm-develUpgrade libX11-debuginfoUpgrade xcb-protoUpgrade libxkbcommonUpgrade libXfont-develUpgrade libXi-debuginfoUpgrade mesa-libOSMesa-develUpgrade libepoxy-develUpgrade mesa-libgbmUpgrade vulkan-debuginfoUpgrade libepoxy-debuginfoUpgrade libxkbcommon-x11Upgrade libXfont2-develUpgrade mesa-vulkan-driversUpgrade libxkbcommon-debuginfoUpgrade libXt-debuginfoUpgrade libXawUpgrade libXt-develUpgrade libXfontUpgrade libvdpau-develUpgrade libwacomUpgrade libevdev-develUpgrade libdrmUpgrade libXtst-develUpgrade libXpmUpgrade mesa-libEGLUpgrade libXrandrUpgrade libdrm-develUpgrade libXfixesUpgrade vulkan-develUpgrade libICE-debuginfoUpgrade libXvMC-develUpgrade libXpm-debuginfoUpgrade libXcursorUpgrade mesa-filesystemUpgrade mesa-debuginfo | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motif-develUpgrade motif | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade libxkbcommon-x11Upgrade libXxf86vmUpgrade mesa-libOSMesaUpgrade libXfixesUpgrade libXpm-develUpgrade drm-utilsUpgrade mesa-libEGLUpgrade xorg-x11-proto-develUpgrade libXcursor-develUpgrade libxkbcommon-develUpgrade libXiUpgrade libXfont2-develUpgrade libxcbUpgrade mesa-libGLUpgrade libXvUpgrade libepoxyUpgrade libxkbfileUpgrade vulkan-develUpgrade libxkbfile-develUpgrade libXrandr-develUpgrade mesa-libOSMesa-develUpgrade libdrm-develUpgrade mesa-libgbmUpgrade libXfont-develUpgrade mesa-private-llvm-develUpgrade libICEUpgrade mesa-libGL-develUpgrade libXrenderUpgrade libxcb-docUpgrade libevdevUpgrade mesa-libxatracker-develUpgrade libX11-commonUpgrade xkeyboard-configUpgrade libevdev-develUpgrade libXvMC-develUpgrade mesa-vulkan-driversUpgrade libepoxy-develUpgrade libXpmUpgrade libXcursorUpgrade libdrmUpgrade mesa-libglapiUpgrade libXv-develUpgrade libevdev-utilsUpgrade mesa-libEGL-develUpgrade mesa-libgbm-develUpgrade xkeyboard-config-develUpgrade libXdmcp-develUpgrade mesa-libGLES-develUpgrade libfontenc-develUpgrade libXaw-develUpgrade libXrandrUpgrade libfontencUpgrade vulkanUpgrade libinputUpgrade libwacomUpgrade libXt-develUpgrade libvdpauUpgrade libX11-develUpgrade libwacom-develUpgrade libxcb-develUpgrade libXfontUpgrade libXvMCUpgrade libXfixes-develUpgrade libxkbcommonUpgrade mesa-libGLESUpgrade libXtstUpgrade libX11Upgrade libinput-develUpgrade libXtst-develUpgrade libXdmcpUpgrade mesa-libxatrackerUpgrade libxkbcommon-x11-develUpgrade libXxf86vm-develUpgrade xcb-protoUpgrade libXi-develUpgrade mesa-dri-driversUpgrade mesa-filesystemUpgrade libXrender-develUpgrade libwacom-dataUpgrade vulkan-filesystemUpgrade libICE-develUpgrade libXtUpgrade mesa-private-llvmUpgrade libvdpau-docsUpgrade libXfont2Upgrade libXawUpgrade libvdpau-devel | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libICEUpgrade libXfont2-develUpgrade libXvMC-develUpgrade mesa-libGLESUpgrade libXrandrUpgrade libwacom-debuginfoUpgrade libxkbcommon-debuginfoUpgrade libdrmUpgrade mesa-vulkan-driversUpgrade libepoxy-debuginfoUpgrade libX11-debuginfoUpgrade libevdev-develUpgrade libwacom-dataUpgrade libwacom-develUpgrade vulkanUpgrade libXtUpgrade libXfixesUpgrade libXpmUpgrade mesa-libGLES-develUpgrade libXvMCUpgrade libXaw-debuginfoUpgrade vulkan-develUpgrade libXt-debuginfoUpgrade vulkan-filesystemUpgrade libXawUpgrade libxkbcommonUpgrade mesa-libgbmUpgrade mesa-debuginfoUpgrade libXrenderUpgrade libXpm-debuginfoUpgrade libXt-develUpgrade mesa-libxatrackerUpgrade mesa-libEGLUpgrade mesa-filesystemUpgrade libXv-develUpgrade mesa-libOSMesaUpgrade vulkan-debuginfoUpgrade libXfont-debuginfoUpgrade libxkbfile-debuginfoUpgrade libXv-debuginfoUpgrade libevdev-utilsUpgrade libXi-debuginfoUpgrade libX11Upgrade libICE-debuginfoUpgrade libXcursorUpgrade libevdevUpgrade libXfont-develUpgrade mesa-libGLUpgrade libXfontUpgrade mesa-libEGL-develUpgrade libvdpau-develUpgrade mesa-private-llvm-debuginfoUpgrade libepoxyUpgrade libepoxy-develUpgrade libxcbUpgrade xkeyboard-config-develUpgrade libfontenc-debuginfoUpgrade libwacomUpgrade libdrm-develUpgrade libxcb-docUpgrade libICE-develUpgrade libXxf86vm-debuginfoUpgrade mesa-private-llvm-develUpgrade libdrm-debuginfoUpgrade libXcursor-develUpgrade libxkbcommon-develUpgrade xkeyboard-configUpgrade mesa-libxatracker-develUpgrade libXdmcp-develUpgrade libXxf86vmUpgrade libxcb-debuginfoNo solution existsUpgrade libXxf86vm-develUpgrade libxcb-develUpgrade libXtstUpgrade libfontenc-develUpgrade mesa-libglapiUpgrade libXdmcpUpgrade xorg-x11-proto-develUpgrade libXiUpgrade libXvUpgrade libinput-debuginfoUpgrade libXaw-develUpgrade libXfont2Upgrade mesa-dri-driversUpgrade libvdpauUpgrade libXrandr-debuginfoUpgrade libXdmcp-debuginfoUpgrade libXrandr-develUpgrade libxkbfile-develUpgrade libXcursor-debuginfoUpgrade libXi-develUpgrade libX11-commonUpgrade mesa-private-llvmUpgrade libXfont2-debuginfoUpgrade libXrender-develUpgrade xcb-protoUpgrade libxkbcommon-x11-develUpgrade libXvMC-debuginfoUpgrade libXfixes-develUpgrade libvdpau-debuginfoUpgrade libXrender-debuginfoUpgrade mesa-libOSMesa-develUpgrade libxkbcommon-x11Upgrade libvdpau-docsUpgrade libXfixes-debuginfoUpgrade libX11-develUpgrade drm-utilsUpgrade mesa-libGL-develUpgrade libevdev-debuginfoUpgrade libinput-develUpgrade libXtst-debuginfoUpgrade libinputUpgrade mesa-libgbm-develUpgrade libxkbfileUpgrade libfontencUpgrade libXtst-develUpgrade libXpm-devel | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade xorg-x11-libXpm-x86Upgrade libXpm-toolsUpgrade xorg-x11-libXpm-develUpgrade xorg-x11-libXpm-devel-32bitUpgrade libXpm-develUpgrade libXpm4Upgrade libXpm4-32bitUpgrade xorg-x11-libXpm-32bitUpgrade xorg-x11-libXpm | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub