Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4367: As per upstream advisory: libXpm Out-of-bounds read in xpmNextWord()
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libXpm | 0:3.5.17-3.amzn2023.0.2 |
| Amazon Linux · 2023 | libXpm-debuginfo | 0:3.5.17-3.amzn2023.0.2 |
| Amazon Linux · 2023 | libXpm-debugsource | 0:3.5.17-3.amzn2023.0.2 |
| Amazon Linux · 2023 | libXpm-devel | 0:3.5.17-3.amzn2023.0.2 |
| Amazon Linux · 2023 | libXpm-devel-debuginfo | 0:3.5.17-3.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 5.5
Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundari…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-4367.html