PT-2004-3705 · Debian+1 · Lesstif-Doc+6

Chris Evans · Published 1970-01-01 · Updated 2023-01-20 · CVE-2004-0687

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lesstif-dev (affected versions not specified) lesstif-bin (affected versions not specified) lesstif1 (affected versions not specified) lesstif-dbg (affected versions not specified) lesstif-doc (affected versions not specified) libXpm versions prior to 6.8.1

Description The issue concerns multiple vulnerabilities in the lesstif package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, multiple stack-based buffer overflows in libXpm before version 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file. The vulnerabilities are found in functions such as xpmParseColors in parse.c, ParseAndPutPixels in create.c, and ParsePixels in parse.c.

Recommendations For lesstif-dev, update to a version that includes the fix for this issue. For lesstif-bin, update to a version that includes the fix for this issue. For lesstif1, update to a version that includes the fix for this issue. For lesstif-dbg, update to a version that includes the fix for this issue. For lesstif-doc, update to a version that includes the fix for this issue. For libXpm, update to version 6.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functions xpmParseColors, ParseAndPutPixels, and ParsePixels until a patch is available.

Fix

Related Identifiers

BDU:2015-03068

BDU:2015-03069

BDU:2015-03070

BDU:2015-03071

BDU:2015-03072

CVE-2004-0687

DSA-560-1

DSA-561-1

HPSBUX02119

RHSA-2004:478

RHSA-2004:537

RHSA-2008:0524

Affected Products

Hp-Ux

Lesstif-Bin

Lesstif-Dbg

Lesstif-Dev

Lesstif-Doc

Lesstif1

Libxpm

References · 34

• https://bdu.fstec.ru/vul/2015-03072 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0687 · Security Note
• http://novell.com/linux/security/advisories/2004_34_xfree86_libs_xshared.html · Vendor Advisory
• http://debian.org/security/2004/dsa-560 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/May/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200502-07.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03071 · Security Note
• http://securityfocus.com/bid/11196 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03070 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0687 · Security Note
• https://bdu.fstec.ru/vul/2015-03069 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200409-34.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-537.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0688 · Security Note