Description
Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | XFree86 +29 | 4.3.0-69.EL | RHSA-2004:478 |
| RHEL 3 | openmotif +1 | 2.2.3-4.RHEL3.4 | RHSA-2004:537 |
| RHEL 3 | openmotif21 | 2.1.30-9.RHEL3.4 | RHSA-2004:537 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Advisories 5
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2004:537 Red Hat Security Advisory: openmotif security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:478 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-561-1 xfree86 - integer and stack overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-560-1 lesstif1-1 - integer and stack overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- VU#537878 third-party-advisory
- RHSA-2005:004 vendor-advisory
- USN-27-1 vendor-advisory
- ADV-2006-1914 vdb-entry
- GLSA-200409-34 vendor-advisory
- TA05-136A third-party-advisory
- MDKSA-2004:098 vendor-advisory
- HPSBUX02119 vendor-advisory
- RHSA-2004:537 vendor-advisory
- 20040915 CESA-2004-004: libXpm mailing-list
- DSA-560 vendor-advisory
- oval:org.mitre.oval:def:11796 vdb-entry signature
- http://scary.beasts.org/security/CESA-2004-003.txt
- APPLE-SA-2005-05-03 vendor-advisory
- CLA-2005:924 vendor-advisory
- SUSE-SA:2004:034 vendor-advisory
- libxpm-xpmfile-integer-overflow(17416) vdb-entry
- 11196 vdb-entry
- GLSA-200502-07 vendor-advisory
- http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch
- FLSA-2006:152803 vendor-advisory
- 20235 third-party-advisory
- 57653 vendor-advisory