Description
Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | xfree86 | 4.1.0-16woody5 | DSA-607-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | XFree86 +29 | 4.3.0-78.EL | RHSA-2004:612 |
| RHEL 3 | openmotif +1 | 2.2.3-4.RHEL3.4 | RHSA-2004:537 |
| RHEL 3 | openmotif21 | 2.1.30-9.RHEL3.4 | RHSA-2004:537 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Advisories 4
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2004:612 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:537 Red Hat Security Advisory: openmotif security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-607-1 xfree86 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2005:004 vendor-advisory
- libxpm-directory-traversal(18146) vdb-entry
- USN-83-1 vendor-advisory
- RHSA-2004:537 vendor-advisory
- libxpm-image-bo(18142) vdb-entry
- 13224 third-party-advisory
- oval:org.mitre.oval:def:9943 vdb-entry signature
- FEDORA-2004-433 vendor-advisory
- http://www.x.org/pub/X11R6.8.1/patches/README.xorg-681-CAN-2004-0914.patch
- RHSA-2004:610 vendor-advisory
- libxpm-improper-memory-access(18144) vdb-entry
- GLSA-200502-07 vendor-advisory
- FLSA-2006:152803 vendor-advisory
- DSA-607 vendor-advisory
- 11694 vdb-entry
- GLSA-200502-06 vendor-advisory
- USN-83-2 vendor-advisory
- HPSBTU01228 vendor-advisory
- MDKSA-2004:137 vendor-advisory
- GLSA-200411-28 vendor-advisory
- libxpm-dos(18147) vdb-entry
- libxpm-command-execution(18145) vdb-entry