Moderate: libXpm security update
Summary
ALSA-2024:2146: Moderate: libXpm security update. Affects libXpm versions < 3.5.13-10.el9. Fixed in 3.5.13-10.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libXpm package is a runtime library for X.Org X11, which provides support for the X PixMap (XPM) image format. XPM is a widely used image format in X Window System applications. The libXpm library allows applications to read and manipulate XPM images. It is an essential component for applications that rely on XPM images for graphical user interfaces.
Vulnerability Detail
The libXpm package is affected by two security vulnerabilities:
-
CVE-2023-43788: This vulnerability is an out-of-bounds read in the XpmCreateXpmImageFromBuffer() function. An attacker can exploit this vulnerability by providing a specially crafted XPM image file, which could lead to a denial of service or potential code execution.
-
CVE-2023-43789: This vulnerability is an out-of-bounds read when processing XPM images with a corrupted colormap. An attacker can exploit this vulnerability by providing a specially crafted XPM image file with a manipulated colormap, which could lead to a denial of service or potential code execution.
How To Fix
Minimum fixed version
3.5.13-10.el9
This is the first release that contains the fix.
sudo dnf update libXpmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is strongly advised to apply the security update as soon as possible.
Conclusion
The libXpm package is affected by two security vulnerabilities that could potentially lead to code execution or denial of service. It is crucial to update the libXpm package to version 3.5.13-10.el9 or later to mitigate these vulnerabilities. No workarounds are available, so it is advised to apply the security update as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libXpm →
FAQ
libXpm is a runtime library for X.Org X11 that provides support for the X PixMap (XPM) image format.
CVE-2023-43788 can allow an attacker to execute arbitrary code or cause a denial of service by providing a specially crafted XPM image file.
CVE-2023-43789 can allow an attacker to execute arbitrary code or cause a denial of service by providing a specially crafted XPM image file with a corrupted colormap.
You can update the libXpm package by using the package manager of your AlmaLinux 9 distribution. For example, you can use the following command: $ sudo yum update libXpm
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for libXpm.
