Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libepoxy-debuginfoUpgrade libXrender-develUpgrade libXrenderUpgrade libXpmUpgrade xcb-protoUpgrade libXvMC-debuginfoUpgrade libXvMC-develUpgrade libdrm-debuginfoUpgrade libXvMCUpgrade libICEUpgrade libXaw-debuginfoUpgrade mesa-libgbm-develUpgrade libXxf86vm-debuginfoUpgrade mesa-libOSMesa-develUpgrade libX11-commonUpgrade libXfont-develUpgrade mesa-libgbmUpgrade libXt-develUpgrade libXt-debuginfoUpgrade libxkbcommon-x11Upgrade libXtst-debuginfoUpgrade libX11Upgrade mesa-libOSMesaUpgrade libXi-debuginfoUpgrade xkeyboard-config-develUpgrade mesa-vulkan-driversUpgrade libXxf86vm-develUpgrade libwacomUpgrade libxkbfile-debuginfoUpgrade libX11-debuginfoUpgrade libXfont2-develUpgrade vulkan-filesystemUpgrade mesa-libEGLUpgrade libwacom-develUpgrade libXtUpgrade libXrandrUpgrade libvdpau-develUpgrade libXawUpgrade libevdev-develUpgrade libXfontUpgrade libepoxy-develUpgrade libXfixesUpgrade mesa-private-llvm-debuginfoUpgrade libXtst-develUpgrade libXcursorUpgrade libxkbcommonUpgrade vulkan-debuginfoUpgrade mesa-debuginfoUpgrade libXpm-debuginfoUpgrade libxkbcommon-debuginfoUpgrade mesa-filesystemUpgrade vulkan-develUpgrade libdrm-develUpgrade libdrmUpgrade libICE-debuginfoUpgrade xorg-x11-proto-develUpgrade mesa-libxatracker-develUpgrade libXv-develUpgrade libxkbfile-develUpgrade mesa-dri-driversUpgrade mesa-libglapiUpgrade libxkbcommon-x11-develUpgrade libX11-develUpgrade libXfixes-develUpgrade libICE-develUpgrade vulkanUpgrade mesa-private-llvm-develUpgrade libvdpauUpgrade libevdev-debuginfoUpgrade libXfont2-debuginfoUpgrade libXcursor-debuginfoUpgrade libXdmcp-develUpgrade libinputUpgrade libXvUpgrade libXxf86vmUpgrade drm-utilsUpgrade mesa-libGL-develUpgrade libxcb-develUpgrade libXdmcpUpgrade libXaw-develUpgrade mesa-libEGL-develUpgrade libXfont-debuginfoUpgrade xkeyboard-configUpgrade mesa-private-llvmUpgrade libXrender-debuginfoUpgrade libXv-debuginfoUpgrade mesa-libGLUpgrade libXdmcp-debuginfoUpgrade libXfixes-debuginfoUpgrade libxcbUpgrade libfontenc-debuginfoUpgrade libevdevUpgrade libinput-develUpgrade libwacom-debuginfoUpgrade libXrandr-develUpgrade libxcb-debuginfoUpgrade mesa-libxatrackerUpgrade libevdev-utilsUpgrade libXcursor-develUpgrade libXpm-develUpgrade libXi-develUpgrade libepoxyUpgrade libinput-debuginfoUpgrade mesa-libGLES-develUpgrade libxkbcommon-develUpgrade libXfont2Upgrade libfontenc-develUpgrade libxkbfileUpgrade libxcb-docUpgrade libXtstUpgrade libXrandr-debuginfoUpgrade libwacom-dataUpgrade libXiUpgrade libvdpau-debuginfoUpgrade libfontencUpgrade mesa-libGLESUpgrade libvdpau-docs | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motif-develUpgrade motif | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade libXvUpgrade libXcursor-develUpgrade mesa-libEGL-develUpgrade xorg-x11-proto-develUpgrade libXpm-develUpgrade libXrenderUpgrade libXxf86vmUpgrade libXiUpgrade xkeyboard-config-develUpgrade drm-utilsUpgrade libxkbcommon-x11Upgrade libICEUpgrade mesa-libGL-develUpgrade mesa-libOSMesa-develUpgrade libxkbfileUpgrade vulkan-develUpgrade libXrandr-develUpgrade mesa-libgbmUpgrade libdrm-develUpgrade mesa-libGLUpgrade libevdev-utilsUpgrade libXaw-develUpgrade libXpmUpgrade mesa-libglapiUpgrade libXv-develUpgrade libXvMC-develUpgrade libX11-commonUpgrade mesa-vulkan-driversUpgrade libxcbUpgrade mesa-libxatracker-develUpgrade xkeyboard-configUpgrade libxcb-docUpgrade mesa-libEGLUpgrade mesa-libOSMesaUpgrade libdrmUpgrade libepoxy-develUpgrade libxkbcommon-develUpgrade libXcursorUpgrade libXfixesUpgrade libevdev-develUpgrade libevdevUpgrade libfontenc-develUpgrade libXdmcp-develUpgrade mesa-libgbm-develUpgrade mesa-libGLES-develUpgrade libXfont2-develUpgrade libepoxyUpgrade libxkbfile-develUpgrade mesa-private-llvm-develUpgrade libXfont-develUpgrade libXrandrUpgrade libinputUpgrade libXtstUpgrade libX11-develUpgrade libxkbcommonUpgrade mesa-libGLESUpgrade libX11Upgrade libXawUpgrade libXfixes-develUpgrade libXtst-develUpgrade libfontencUpgrade libXdmcpUpgrade libvdpauUpgrade xcb-protoUpgrade mesa-filesystemUpgrade mesa-dri-driversUpgrade libXi-develUpgrade vulkanUpgrade libXfontUpgrade libXfont2Upgrade libvdpau-develUpgrade libxcb-develUpgrade libwacom-develUpgrade libXrender-develUpgrade libxkbcommon-x11-develUpgrade libwacomUpgrade libXxf86vm-develUpgrade libXt-develUpgrade libXtUpgrade libwacom-dataUpgrade libXvMCUpgrade libinput-develUpgrade libvdpau-docsUpgrade mesa-libxatrackerUpgrade libICE-develUpgrade vulkan-filesystemUpgrade mesa-private-llvm | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libwacomUpgrade libICEUpgrade libXpm-debuginfoUpgrade libepoxyUpgrade vulkan-develUpgrade mesa-libxatrackerUpgrade libxcbUpgrade libxkbfile-debuginfoUpgrade libwacom-dataUpgrade libdrm-develUpgrade vulkan-debuginfoUpgrade libevdev-develUpgrade libXaw-debuginfoUpgrade libXfont2-develUpgrade libvdpau-develUpgrade libXxf86vm-debuginfoUpgrade mesa-filesystemUpgrade libXvMC-develUpgrade vulkanUpgrade libXi-debuginfoUpgrade mesa-libOSMesaUpgrade libfontenc-debuginfoUpgrade libXvMCUpgrade libdrmUpgrade libxkbcommonUpgrade libepoxy-develUpgrade xkeyboard-config-develUpgrade libXt-debuginfoUpgrade libXrandrUpgrade libXawUpgrade libXv-debuginfoUpgrade mesa-libEGL-develUpgrade libXfont-debuginfoUpgrade libevdev-utilsUpgrade mesa-private-llvm-debuginfoUpgrade libXrenderUpgrade libICE-debuginfoUpgrade libXcursorUpgrade libXtUpgrade libwacom-develUpgrade vulkan-filesystemUpgrade libepoxy-debuginfoUpgrade libXfont-develUpgrade mesa-debuginfoUpgrade mesa-libgbmUpgrade libX11Upgrade libxkbcommon-debuginfoUpgrade libXt-develUpgrade mesa-libGLUpgrade libXv-develUpgrade libXpmUpgrade libXfontUpgrade libxcb-docUpgrade mesa-libGLES-develUpgrade libevdevUpgrade libICE-develUpgrade mesa-libGLESUpgrade libXfixesUpgrade mesa-vulkan-driversUpgrade mesa-libEGLUpgrade libX11-debuginfoUpgrade libwacom-debuginfoUpgrade libXfont2Upgrade libXvUpgrade libxkbfileUpgrade mesa-libGL-develUpgrade mesa-private-llvm-develUpgrade libXtst-develUpgrade libinput-debuginfoUpgrade drm-utilsUpgrade libXpm-develUpgrade libfontenc-develUpgrade libX11-commonUpgrade libfontencUpgrade libvdpau-docsUpgrade libXrandr-debuginfoUpgrade libxcb-develUpgrade libXxf86vmUpgrade libxkbcommon-x11Upgrade libXrender-debuginfoUpgrade libXcursor-debuginfoUpgrade mesa-dri-driversUpgrade mesa-libxatracker-develUpgrade xorg-x11-proto-develUpgrade mesa-private-llvmUpgrade libvdpauUpgrade libxcb-debuginfoUpgrade libXxf86vm-develUpgrade libXfixes-develUpgrade libXvMC-debuginfoUpgrade libinput-develUpgrade mesa-libgbm-develUpgrade mesa-libOSMesa-develUpgrade libX11-develUpgrade libinputUpgrade libvdpau-debuginfoUpgrade libXfont2-debuginfoUpgrade libXfixes-debuginfoUpgrade libdrm-debuginfoUpgrade libxkbfile-develUpgrade libXrender-develUpgrade libXdmcp-debuginfoUpgrade libXrandr-develUpgrade xcb-protoUpgrade libXaw-develUpgrade libxkbcommon-x11-develUpgrade libXdmcpUpgrade libXtstUpgrade mesa-libglapiUpgrade libXtst-debuginfoUpgrade libXdmcp-develUpgrade libevdev-debuginfoUpgrade libxkbcommon-develNo solution existsUpgrade libXcursor-develUpgrade libXi-develUpgrade libXiUpgrade xkeyboard-config | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade xorg-x11-libXpm-32bitUpgrade libXpm4Upgrade libXpm4-32bitUpgrade xorg-x11-libXpmUpgrade xorg-x11-libXpm-x86Upgrade xorg-x11-libXpm-devel-32bitUpgrade libXpm-toolsUpgrade libXpm-develUpgrade xorg-x11-libXpm-devel | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub