CVE-2023-43789

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

X.Org X11 libXpm runtime library

Security Fix(es):

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system.(CVE-2023-43788)

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.(CVE-2023-43789)

X.Org X11 libXpm runtime library.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)

• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)

• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)

• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

X.Org X11 libXpm runtime library.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)
• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)
• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

X.Org X11 libXpm runtime library.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)
• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)
• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()
• CVE-2023-43789: out of bounds read on XPM with corrupted colormap

• CVE-2023-43788: fix out of bounds read in XpmCreateXpmImageFromBuffer
• CVE-2023-43789: fix out of bounds read on XPM with corrupted colormap

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system. (CVE-2023-43788)

Out of bounds read on XPM with corrupted colormap. (CVE-2023-43789)

These are all security issues fixed in the libXpm-devel-3.5.17-1.1 package on the GA media of openSUSE Tumbleweed.

X.Org X11 libXpm runtime library.

Security Fix(es):

• libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)

• libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

This update for libXpm fixes the following issues:

• CVE-2023-43788: Fixed an out of bounds read when creating an image (bsc#1215686).
• CVE-2023-43789: Fixed an out of bounds read when parsing an XPM file with a corrupted colormap (bsc#1215687).

This update for libXpm fixes the following issues:

• CVE-2023-43788: Fixed an out of bounds read when creating an image (bsc#1215686).
• CVE-2023-43789: Fixed an out of bounds read when parsing an XPM file with a corrupted colormap (bsc#1215687).

Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to consume memory, leading to a denial of service. (CVE-2023-43786)

Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could use this issue to cause libXpm to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2023-43787)

Alan Coopersmith discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to cause libXpm to crash, leading to a denial of service. (CVE-2023-43788, CVE-2023-43789)

USN-6408-1 fixed several vulnerabilities in libXpm. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to consume memory, leading to a denial of service. (CVE-2023-43786)

Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could use this issue to cause libXpm to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2023-43787)

Alan Coopersmith discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to cause libXpm to crash, leading to a denial of service. (CVE-2023-43788, CVE-2023-43789)