Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libdrm-debuginfoUpgrade libxkbcommonUpgrade libX11-commonUpgrade libXvMC-develUpgrade mesa-libEGLUpgrade libXt-develUpgrade libICE-debuginfoUpgrade libXtst-develUpgrade mesa-filesystemUpgrade libXvMCUpgrade libdrm-develUpgrade libXtUpgrade libXtst-debuginfoUpgrade libXpmUpgrade libXfixesUpgrade libdrmUpgrade libxkbcommon-debuginfoUpgrade libxkbcommon-x11Upgrade libXrenderUpgrade libXfontUpgrade libepoxy-debuginfoUpgrade vulkan-filesystemUpgrade libXrandrUpgrade mesa-libgbmUpgrade libXi-debuginfoUpgrade xkeyboard-config-develUpgrade libXt-debuginfoUpgrade libXawUpgrade libvdpau-develUpgrade libXpm-debuginfoUpgrade mesa-libOSMesaUpgrade vulkan-debuginfoUpgrade mesa-private-llvm-debuginfoUpgrade vulkan-develUpgrade xcb-protoUpgrade libepoxy-develUpgrade mesa-libOSMesa-develUpgrade libxkbfile-debuginfoUpgrade libevdev-develUpgrade libXrender-develUpgrade libwacomUpgrade libX11-debuginfoUpgrade mesa-vulkan-driversUpgrade libXxf86vm-develUpgrade libXfont2-develUpgrade libX11Upgrade libXcursorUpgrade mesa-debuginfoUpgrade libXvMC-debuginfoUpgrade mesa-libgbm-develUpgrade libXaw-debuginfoUpgrade libwacom-develUpgrade libICEUpgrade libXfont-develUpgrade libXxf86vm-debuginfoUpgrade libXrandr-debuginfoUpgrade libevdev-debuginfoUpgrade libXpm-develUpgrade libxkbfileUpgrade mesa-libglapiUpgrade xkeyboard-configUpgrade libXaw-develUpgrade xorg-x11-proto-develUpgrade libxcb-develUpgrade libXdmcp-debuginfoUpgrade libepoxyUpgrade libXrandr-develUpgrade libICE-develUpgrade libevdev-utilsUpgrade libxcbUpgrade mesa-libxatrackerUpgrade libfontenc-debuginfoUpgrade mesa-libEGL-develUpgrade libXdmcpUpgrade libXrender-debuginfoUpgrade libxkbcommon-x11-develUpgrade libXdmcp-develUpgrade mesa-libGLUpgrade libinput-debuginfoUpgrade libxkbfile-develUpgrade mesa-libGL-develUpgrade libXxf86vmUpgrade drm-utilsUpgrade libinputUpgrade libXvUpgrade libXv-develUpgrade libXfont2-debuginfoUpgrade libXtstUpgrade libxcb-docUpgrade libvdpau-docsUpgrade libvdpauUpgrade libwacom-dataUpgrade mesa-libGLES-develUpgrade libfontencUpgrade libXiUpgrade libXcursor-debuginfoUpgrade libxkbcommon-develUpgrade libvdpau-debuginfoUpgrade libXfont2Upgrade mesa-libGLESUpgrade vulkanUpgrade mesa-libxatracker-develUpgrade libwacom-debuginfoUpgrade libxcb-debuginfoUpgrade libXfixes-develUpgrade libX11-develUpgrade libXcursor-develUpgrade mesa-private-llvm-develUpgrade libfontenc-develUpgrade libXi-develUpgrade mesa-private-llvmUpgrade libXv-debuginfoUpgrade mesa-dri-driversUpgrade libXfixes-debuginfoUpgrade libXfont-debuginfoUpgrade libinput-develUpgrade libevdev | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motif-develUpgrade motif | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade mesa-libEGLUpgrade libevdevUpgrade mesa-vulkan-driversUpgrade libXxf86vmUpgrade mesa-libGLES-develUpgrade libICEUpgrade mesa-libgbm-develUpgrade libXfixesUpgrade libxcb-docUpgrade mesa-libGLUpgrade libfontenc-develUpgrade xorg-x11-proto-develUpgrade libXvUpgrade libxkbfileUpgrade libXfont-develUpgrade libxkbfile-develUpgrade mesa-libOSMesa-develUpgrade vulkan-develUpgrade libXcursorUpgrade mesa-libglapiUpgrade mesa-libOSMesaUpgrade libxkbcommon-develUpgrade mesa-libEGL-develUpgrade mesa-private-llvm-develUpgrade libdrmUpgrade libXpm-develUpgrade libXrenderUpgrade libevdev-utilsUpgrade libXfont2-develUpgrade libevdev-develUpgrade libdrm-develUpgrade libXvMC-develUpgrade libXrandrUpgrade libXdmcp-develUpgrade mesa-libxatracker-develUpgrade libXpmUpgrade libxcbUpgrade libXv-develUpgrade xkeyboard-configUpgrade libX11-commonUpgrade libXaw-develUpgrade mesa-libGL-develUpgrade drm-utilsUpgrade mesa-libgbmUpgrade libxkbcommon-x11Upgrade libXrandr-develUpgrade libepoxy-develUpgrade xkeyboard-config-develUpgrade libXcursor-develUpgrade libXiUpgrade libepoxyUpgrade libXvMCUpgrade libxkbcommon-x11-develUpgrade libXt-develUpgrade libxkbcommonUpgrade vulkanUpgrade libXtUpgrade libXfontUpgrade libXawUpgrade libXrender-develUpgrade libvdpau-develUpgrade libXfixes-develUpgrade libXfont2Upgrade libwacomUpgrade libXxf86vm-develUpgrade libxcb-develUpgrade libwacom-develUpgrade libvdpauUpgrade libICE-develUpgrade mesa-private-llvmUpgrade vulkan-filesystemUpgrade libwacom-dataUpgrade libvdpau-docsUpgrade mesa-libxatrackerUpgrade libX11Upgrade libinput-develUpgrade libXtst-develUpgrade libXtstUpgrade xcb-protoUpgrade mesa-dri-driversUpgrade libXi-develUpgrade libXdmcpUpgrade libfontencUpgrade libX11-develUpgrade mesa-libGLESUpgrade mesa-filesystemUpgrade libinput | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libXrender-debuginfoUpgrade mesa-private-llvm-develUpgrade libXpm-develUpgrade libXrandr-develUpgrade libXtst-develUpgrade mesa-libOSMesa-develUpgrade libXcursor-debuginfoUpgrade mesa-libglapiUpgrade mesa-dri-driversUpgrade libXrandr-debuginfoUpgrade libXi-develUpgrade libfontencUpgrade libXtstUpgrade libXvUpgrade libxkbcommon-x11Upgrade libinput-debuginfoNo solution existsUpgrade libdrm-debuginfoUpgrade libxcb-develUpgrade libXxf86vmUpgrade mesa-libxatracker-develUpgrade libX11-develUpgrade libXdmcp-develUpgrade libXtst-debuginfoUpgrade libxkbcommon-x11-develUpgrade libXvMC-debuginfoUpgrade libXfont2-debuginfoUpgrade libX11-commonUpgrade drm-utilsUpgrade xkeyboard-configUpgrade mesa-libgbm-develUpgrade libXaw-develUpgrade libXrender-develUpgrade libvdpau-debuginfoUpgrade libXfont2Upgrade libxcb-debuginfoUpgrade libxkbcommon-develUpgrade libevdev-debuginfoUpgrade libinput-develUpgrade libinputUpgrade libXcursor-develUpgrade libXxf86vm-develUpgrade xcb-protoUpgrade libvdpauUpgrade libxkbfileUpgrade xorg-x11-proto-develUpgrade libfontenc-develUpgrade libxkbfile-develUpgrade libXdmcpUpgrade libXiUpgrade libXdmcp-debuginfoUpgrade mesa-private-llvmUpgrade mesa-libGL-develUpgrade libvdpau-docsUpgrade libXfixes-debuginfoUpgrade libXfixes-develUpgrade libwacomUpgrade libXi-debuginfoUpgrade libevdev-utilsUpgrade libxkbfile-debuginfoUpgrade mesa-libEGLUpgrade libICEUpgrade libXvMCUpgrade libXrandrUpgrade vulkan-debuginfoUpgrade libwacom-develUpgrade vulkanUpgrade libXawUpgrade libXtUpgrade libXpmUpgrade mesa-filesystemUpgrade libXcursorUpgrade mesa-libxatrackerUpgrade libICE-debuginfoUpgrade mesa-libGLUpgrade libX11-debuginfoUpgrade libXaw-debuginfoUpgrade libXfontUpgrade libXrenderUpgrade libepoxy-develUpgrade libXt-develUpgrade mesa-private-llvm-debuginfoUpgrade libdrm-develUpgrade libepoxy-debuginfoUpgrade libXpm-debuginfoUpgrade libxkbcommon-debuginfoUpgrade xkeyboard-config-develUpgrade libXfont2-develUpgrade libfontenc-debuginfoUpgrade libxcb-docUpgrade libdrmUpgrade libXxf86vm-debuginfoUpgrade mesa-libOSMesaUpgrade mesa-debuginfoUpgrade libXfixesUpgrade libepoxyUpgrade mesa-libGLESUpgrade mesa-libgbmUpgrade libXv-debuginfoUpgrade libxkbcommonUpgrade libXvMC-develUpgrade libevdevUpgrade libXfont-develUpgrade libxcbUpgrade libwacom-dataUpgrade mesa-libGLES-develUpgrade mesa-vulkan-driversUpgrade mesa-libEGL-develUpgrade libvdpau-develUpgrade libX11Upgrade vulkan-develUpgrade libICE-develUpgrade libevdev-develUpgrade libwacom-debuginfoUpgrade vulkan-filesystemUpgrade libXfont-debuginfoUpgrade libXv-develUpgrade libXt-debuginfo | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade libXpm4-32bitUpgrade xorg-x11-libXpmUpgrade libXpm4Upgrade xorg-x11-libXpm-32bitUpgrade xorg-x11-libXpm-develUpgrade libXpm-toolsUpgrade xorg-x11-libXpm-x86Upgrade xorg-x11-libXpm-devel-32bitUpgrade libXpm-devel | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub