PT-2004-1943 · X.Org · Libxpm

Published 2004-12-15 · Updated 2017-10-11 · CVE-2004-0914

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: libXpm versions 6.8.1 and earlier

Description: The issue involves multiple problems in libXpm, including integer overflows, out-of-bounds memory accesses, directory traversal, shell metacharacter, endless loops, and memory leaks. These could allow remote attackers to obtain sensitive information, cause a denial of service, or execute arbitrary code via a certain XPM image file.

Recommendations: For libXpm versions 6.8.1 and earlier, consider updating to a version later than 6.8.1 to resolve the issue. As a temporary workaround, restrict the use of XPM image files to minimize the risk of exploitation. Avoid using potentially malicious XPM files until the issue is resolved.

Fix

Related Identifiers

CVE-2004-0914

DSA-607-1

RHSA-2004:537

RHSA-2004:612

RHSA-2008:0524

Affected Products

Libxpm

References · 23

• http://gentoo.org/security/en/glsa/glsa-200502-07.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0914 · Security Note
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTU01228 · Vendor Advisory
• http://secunia.com/advisories/13224 · Vendor Advisory
• http://redhat.com/archives/fedora-legacy-announce/2006-January/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-610.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:137 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2004-537.html · Vendor Advisory
• http://ubuntu.com/usn/usn-83-1 · Vendor Advisory
• http://securityfocus.com/bid/11694 · Vendor Advisory
• http://debian.org/security/2004/dsa-607 · Vendor Advisory
• http://linuxsecurity.com/content/view/106877/102 · Vendor Advisory
• http://ubuntu.com/usn/usn-83-2 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200502-06.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200411-28.xml · Vendor Advisory