Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxpm | Aug 30, 2017 | Feb 1, 2017 |
| Centos_linux | — | Upgrade libXfontUpgrade libXrender-develUpgrade libXvMC-debuginfoUpgrade libX11-debuginfoUpgrade libXxf86vm-debuginfoUpgrade libvdpau-develUpgrade mesa-libOSMesaUpgrade libdrm-develUpgrade libICEUpgrade libXpmUpgrade libXpm-debuginfoUpgrade libXtst-develUpgrade mesa-libEGLUpgrade libICE-debuginfoUpgrade libXcursorUpgrade libXrandrUpgrade libdrmUpgrade vulkan-develUpgrade libxkbcommon-debuginfoUpgrade libXfixesUpgrade libXawUpgrade libwacomUpgrade mesa-debuginfoUpgrade libXaw-debuginfoUpgrade libXvMCUpgrade libxkbcommonUpgrade libXvMC-develUpgrade libXfont2-develUpgrade libwacom-develUpgrade vulkan-debuginfoUpgrade libX11-commonUpgrade mesa-private-llvm-debuginfoUpgrade libXtUpgrade libdrm-debuginfoUpgrade libXt-develUpgrade libXtst-debuginfoUpgrade libX11Upgrade libXfont-develUpgrade libXrenderUpgrade mesa-libgbm-develUpgrade libXt-debuginfoUpgrade mesa-vulkan-driversUpgrade libevdev-develUpgrade libxkbfile-debuginfoUpgrade xkeyboard-config-develUpgrade libXxf86vm-develUpgrade mesa-libOSMesa-develUpgrade mesa-filesystemUpgrade xcb-protoUpgrade vulkan-filesystemUpgrade libxkbcommon-x11Upgrade mesa-libgbmUpgrade libepoxy-develUpgrade libepoxy-debuginfoUpgrade libXi-debuginfoUpgrade libXrender-debuginfoUpgrade libXdmcpUpgrade drm-utilsUpgrade libXrandr-develUpgrade xkeyboard-configUpgrade libICE-develUpgrade libepoxyUpgrade mesa-libGLESUpgrade libxcb-docUpgrade libXrandr-debuginfoUpgrade libXaw-develUpgrade libevdev-debuginfoUpgrade mesa-private-llvm-develUpgrade libX11-develUpgrade mesa-libGL-develUpgrade mesa-libxatracker-develUpgrade libXcursor-develUpgrade libfontenc-debuginfoUpgrade libxkbcommon-develUpgrade libXfont2-debuginfoUpgrade libwacom-debuginfoUpgrade libXcursor-debuginfoUpgrade mesa-libGLES-develUpgrade libXfont2Upgrade vulkanUpgrade libXtstUpgrade libXfixes-develUpgrade libfontencUpgrade libvdpau-docsUpgrade libvdpau-debuginfoUpgrade libXv-develUpgrade libXpm-develUpgrade libXiUpgrade mesa-libglapiUpgrade libxkbfileUpgrade libwacom-dataUpgrade libXdmcp-develUpgrade libXxf86vmUpgrade libinputUpgrade libXvUpgrade libfontenc-develUpgrade mesa-libEGL-develUpgrade libxkbcommon-x11-develUpgrade libvdpauUpgrade libXi-develUpgrade mesa-private-llvmUpgrade libxcbUpgrade libXv-debuginfoUpgrade libinput-develUpgrade libXfont-debuginfoUpgrade libevdev-utilsUpgrade libXfixes-debuginfoUpgrade mesa-libGLUpgrade mesa-dri-driversUpgrade xorg-x11-proto-develUpgrade libxkbfile-develUpgrade libxcb-develUpgrade libinput-debuginfoUpgrade mesa-libxatrackerUpgrade libevdevUpgrade libxcb-debuginfoUpgrade libXdmcp-debuginfo | Aug 28, 2019 | Feb 1, 2017 |
| Debian | — | Upgrade libxpm | Jan 27, 2017 | Jan 26, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXpm. | Oct 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Nov 30, 2017 | Feb 1, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade motifUpgrade motif-devel | Mar 13, 2024 | Feb 1, 2017 |
| Oracle Solaris | — | Upgrade x11/library/libxpm to version 3.5.11-0.175.3.20.0.2.1526 on Solaris 11.3 | May 29, 2017 | Feb 1, 2017 |
| Oracle_linux | — | Upgrade libxkbcommon-x11-develUpgrade libXfixes-develUpgrade libXvMCUpgrade libwacom-develUpgrade libxcb-develUpgrade libvdpau-docsUpgrade libX11-develUpgrade libvdpau-develUpgrade libvdpauUpgrade libX11Upgrade libXfont2Upgrade mesa-libGLESUpgrade libXt-develUpgrade mesa-filesystemUpgrade libXxf86vm-develUpgrade vulkanUpgrade mesa-private-llvmUpgrade libXtUpgrade libinputUpgrade libwacom-dataUpgrade mesa-libxatrackerUpgrade libICE-develUpgrade libfontencUpgrade libwacomUpgrade libXfontUpgrade libXawUpgrade libXrender-develUpgrade libinput-develUpgrade libxkbcommonUpgrade vulkan-filesystemUpgrade mesa-dri-driversUpgrade libXtstUpgrade libXtst-develUpgrade libXi-develUpgrade libXdmcpUpgrade xcb-protoUpgrade libxkbcommon-develUpgrade libXiUpgrade libXaw-develUpgrade mesa-libgbmUpgrade mesa-libGLUpgrade libXvMC-develUpgrade libevdevUpgrade libepoxy-develUpgrade libXcursor-develUpgrade libXcursorUpgrade libXrenderUpgrade libXpm-develUpgrade libXxf86vmUpgrade mesa-libEGL-develUpgrade xkeyboard-config-develUpgrade mesa-libEGLUpgrade mesa-libOSMesaUpgrade mesa-libGL-develUpgrade libXrandr-develUpgrade libICEUpgrade libxkbcommon-x11Upgrade libxkbfile-develUpgrade libXfixesUpgrade drm-utilsUpgrade libepoxyUpgrade vulkan-develUpgrade libxkbfileUpgrade mesa-libOSMesa-develUpgrade libXrandrUpgrade mesa-libGLES-develUpgrade libfontenc-develUpgrade libxcbUpgrade libXdmcp-develUpgrade libXfont2-develUpgrade mesa-libgbm-develUpgrade libXpmUpgrade libevdev-utilsUpgrade libdrm-develUpgrade libdrmUpgrade libXvUpgrade mesa-libglapiUpgrade xorg-x11-proto-develUpgrade libX11-commonUpgrade libXfont-develUpgrade mesa-private-llvm-develUpgrade libXv-develUpgrade mesa-vulkan-driversUpgrade libevdev-develUpgrade xkeyboard-configUpgrade libxcb-docUpgrade mesa-libxatracker-devel | Aug 8, 2017 | Dec 12, 2016 |
| Redhat_linux | — | Upgrade libinput-debuginfoUpgrade libXvUpgrade libfontenc-develUpgrade libXaw-develUpgrade libXdmcp-develUpgrade mesa-libglapiUpgrade drm-utilsUpgrade libXcursor-develUpgrade libxcb-debuginfoUpgrade libXdmcpUpgrade libXxf86vm-develNo solution existsUpgrade libX11-commonUpgrade xcb-protoUpgrade mesa-private-llvmUpgrade libvdpau-debuginfoUpgrade libxkbfile-develUpgrade libinputUpgrade libXfixes-develUpgrade libXfont2-debuginfoUpgrade libXcursor-debuginfoUpgrade mesa-dri-driversUpgrade mesa-libgbm-develUpgrade libinput-develUpgrade mesa-private-llvm-develUpgrade libXi-develUpgrade libXrandr-debuginfoUpgrade libevdev-debuginfoUpgrade libvdpauUpgrade libXiUpgrade libxkbcommon-develUpgrade libxcb-develUpgrade libxkbcommon-x11Upgrade libXtst-develUpgrade libXrender-debuginfoUpgrade libXpm-develUpgrade mesa-libxatracker-develUpgrade libXfixes-debuginfoUpgrade libdrm-debuginfoUpgrade libX11-develUpgrade mesa-libOSMesa-develUpgrade libXfont2Upgrade libxkbcommon-x11-develUpgrade xkeyboard-configUpgrade libXrender-develUpgrade mesa-libGL-develUpgrade libXrandr-develUpgrade xorg-x11-proto-develUpgrade libXtst-debuginfoUpgrade libXvMC-debuginfoUpgrade libvdpau-docsUpgrade libXxf86vmUpgrade libXdmcp-debuginfoUpgrade libXtstUpgrade libfontencUpgrade libxkbfileUpgrade libXvMCUpgrade xkeyboard-config-develUpgrade libxkbcommonUpgrade vulkan-debuginfoUpgrade libwacom-develUpgrade libXpmUpgrade libwacomUpgrade mesa-vulkan-driversUpgrade libdrm-develUpgrade libxcbUpgrade libdrmUpgrade libX11Upgrade libX11-debuginfoUpgrade libepoxy-develUpgrade vulkan-filesystemUpgrade libXtUpgrade libXi-debuginfoUpgrade libICE-debuginfoUpgrade mesa-libGLES-develUpgrade libxcb-docUpgrade mesa-libgbmUpgrade libxkbfile-debuginfoUpgrade libevdev-develUpgrade libXt-develUpgrade libXrenderUpgrade libwacom-debuginfoUpgrade libXaw-debuginfoUpgrade libXfontUpgrade libXfont-develUpgrade libfontenc-debuginfoUpgrade libXawUpgrade libXxf86vm-debuginfoUpgrade mesa-libEGL-develUpgrade libvdpau-develUpgrade mesa-private-llvm-debuginfoUpgrade libXvMC-develUpgrade libXcursorUpgrade libXfixesUpgrade vulkanUpgrade libxkbcommon-debuginfoUpgrade libXpm-debuginfoUpgrade mesa-debuginfoUpgrade libXfont2-develUpgrade libwacom-dataUpgrade libXt-debuginfoUpgrade libepoxyUpgrade libICEUpgrade mesa-libGLESUpgrade libXrandrUpgrade libXfont-debuginfoUpgrade mesa-libOSMesaUpgrade libXv-develUpgrade mesa-filesystemUpgrade libepoxy-debuginfoUpgrade libXv-debuginfoUpgrade libevdev-utilsUpgrade mesa-libGLUpgrade mesa-libxatrackerUpgrade libICE-develUpgrade vulkan-develUpgrade mesa-libEGLUpgrade libevdev | Aug 5, 2017 | Jan 26, 2017 |
| Suse | — | Upgrade xorg-x11-libXpm-develUpgrade xorg-x11-libXpm-devel-32bitUpgrade xorg-x11-libXpm-x86Upgrade libXpm-develUpgrade libXpm-toolsUpgrade xorg-x11-libXpmUpgrade libXpm4Upgrade xorg-x11-libXpm-32bitUpgrade libXpm4-32bit | Feb 16, 2017 | Jan 26, 2017 |
| Ubuntu | — | Upgrade libxpm4 | Feb 2, 2017 | Jan 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub