Medium ALAS2023-2023-381 1 CVE

Moderate: libXpm security update (Amazon Linux 2023)

Published Oct 12, 2023 · Updated Oct 24, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43788: libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() NOTE: https://www.openwall.com/lists/oss-security/2023/10/03/1 NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/2fa554b01ef6079a9b35df9332bdc4f139ed67e0

Fixed packages 5

Release	Package	Fixed in
Amazon Linux · 2023	libXpm	0:3.5.15-2.amzn2023.0.2
Amazon Linux · 2023	libXpm-debuginfo	0:3.5.15-2.amzn2023.0.2
Amazon Linux · 2023	libXpm-debugsource	0:3.5.15-2.amzn2023.0.2
Amazon Linux · 2023	libXpm-devel	0:3.5.15-2.amzn2023.0.2
Amazon Linux · 2023	libXpm-devel-debuginfo	0:3.5.15-2.amzn2023.0.2

Vulnerabilities 1

Medium 5.5

CVE-2023-43788

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Oct 10, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-43788.html