{"id":"CVE-2023-43789","aliases":["ALPINE-CVE-2023-43789","ALSA-2024:2146","ALSA-2024:2217","ALSA-2024:2974","ALSA-2024:3022","AZL-31490","BELL-CVE-2023-43789","CLSA-2026-1778167813","CLSA-2026-1779823076","DEBIAN-CVE-2023-43789","DLA-3603-1","DSA-5516-1","EUVD-2023-48166","GHSA-738h-f6r7-jx59","JLSEC-2026-287","MGASA-2023-0292","OESA-2023-1710","RHSA-2024:2146","RHSA-2024:2217","RHSA-2024:2974","RHSA-2024:3022","RLSA-2024:2146","RLSA-2024:2217","RLSA-2024:2974","RLSA-2024:3022","SUSE-SU-2023:3962-1","SUSE-SU-2023:3965-1","UBUNTU-CVE-2023-43789","USN-6408-1","USN-6408-2","openSUSE-SU-2024:13297-1"],"status":"published","title":"Libxpm: out of bounds read on xpm with corrupted colormap","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00364,"percentile":0.30424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-10-03T00:00:00Z","modified":"2026-10-29T11:31:42Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libXpm","fixed_in":["3.5.17-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","fixed_in":["3.5.17-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxpm","fixed_in":["1:3.5.12-1.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxpm","fixed_in":["1:3.5.17-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxpm","fixed_in":["1:3.5.17-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Xorg_libXpm_jll","fixed_in":["3.5.17+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxpm","fixed_in":["1:3.5.10-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxpm","fixed_in":["1:3.5.11-1ubuntu0.16.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1ubuntu0.18.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1.1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"motif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"motif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"motif-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.17-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-8.el9_1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-8.el9_1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-27.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"motif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-27.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"motif-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-27.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1+deb12u1"}]}],"versions":["1:3.5.12-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1+deb10u2"}]}],"versions":["1:3.5.12-1","1:3.5.12-1+deb10u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1+deb11u1"}]}],"versions":["1:3.5.12-1","1:3.5.12-1.1","1:3.5.12-1.1~deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1+deb12u1"}]}],"versions":["1:3.5.12-1.1"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Xorg_libXpm_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.17+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.15-1.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.15-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-3.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-3.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-5.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-5.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-5.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXpm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXpm-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"motif-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"motif-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"motif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"motif-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXpm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXpm-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"motif-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.13-10.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-28.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.12-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.4-20.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.11-6.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.11-6.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.11-6.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.10-1ubuntu0.1+esm2"}]}],"versions":["1:3.5.10-1","1:3.5.10-1ubuntu0.1","1:3.5.10-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-4","2.3.4-5","2.3.4-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.11-1ubuntu0.16.04.1+esm2"}]}],"versions":["1:3.5.11-1","1:3.5.11-1ubuntu0.16.04.1","1:3.5.11-1ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-8ubuntu1","2.3.4-9","2.3.4-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.18.04.2+esm1"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7-2","2.3.8-1","2.3.8-2","2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.20.04.2"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.2"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1.1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3","2.3.8-3.1","2.3.8-3.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-4","2.3.8-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5","2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.20.04.2"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.20.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.2"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.10-1ubuntu0.1+esm2"}]}],"versions":["1:3.5.10-1","1:3.5.10-1ubuntu0.1","1:3.5.10-1ubuntu0.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.11-1ubuntu0.16.04.1+esm2"}]}],"versions":["1:3.5.11-1","1:3.5.11-1ubuntu0.16.04.1","1:3.5.11-1ubuntu0.16.04.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.18.04.2+esm1"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.18.04.2"],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libxpm_project","product":"libxpm"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2146","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2217","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2974","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3022","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43789","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242249","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747/","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00005.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43789","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747"},{"url":"https://github.com/advisories/GHSA-738h-f6r7-jx59"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-43789","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43788","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242248","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242249","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2146.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2217.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-2974.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3022.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-43789","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778167813.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779823076.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43789.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43789","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0292.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32359","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/03/1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43788","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242248","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2146.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43788","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43789","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2217.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2974.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3022.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2146","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2217","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2974","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3022","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215686","tags":["report"]},{"url":"https://bugzilla.suse.com/1215687","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43789","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233965-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43789","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6408-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6408-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-43787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-43788","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-43789","title":"Libxpm: out of bounds read on xpm with corrupted colormap","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T11:43:20.009Z","modified":"2026-11-07T11:32:45.654Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T12:33:58.237937Z"}],"euvd":[{"id":"EUVD-2023-48166","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T11:43:20Z","modified":"2026-11-07T11:32:45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T12:09:17.956424Z"}],"ghsa":[{"id":"GHSA-738h-f6r7-jx59","title":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a...","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T12:30:24Z","modified":"2025-11-04T21:30:45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:36.009389Z"}],"nvd":[{"id":"CVE-2023-43789","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T12:15:10.71Z","modified":"2026-11-07T12:17:35.96Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T14:05:24.982965Z"}],"osv":[{"id":"ALPINE-CVE-2023-43789","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T12:15:10.71Z","modified":"2026-10-26T17:17:58.644389361Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-31490","title":"CVE-2023-43789 affecting package libXpm for versions less than 3.5.17-1","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T12:15:10Z","modified":"2026-04-21T04:26:19.44632Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"BELL-CVE-2023-43789","status":"published","published":"2023-10-11T13:25:56.151813Z","modified":"2026-09-06T07:15:24.472180307Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-43789","title":"Libxpm: out of bounds read on xpm with corrupted colormap","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T11:43:20.009Z","modified":"2026-11-09T02:30:54.452733059Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-08T02:57:32.649963Z"},{"id":"DEBIAN-CVE-2023-43789","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-12T12:15:10.71Z","modified":"2026-11-08T09:47:37.716846406Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-08T10:03:28.621517Z"},{"id":"JLSEC-2026-287","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2026-04-28T13:07:10.945Z","modified":"2026-07-18T00:00:40.367927668Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1710","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system.(CVE-2023-43788)\r\n\r\nA vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.(CVE-2023-43789)","status":"published","published":"2023-10-13T11:06:09Z","modified":"2026-08-18T01:17:54.874289539Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2024:2146","title":"Red Hat Security Advisory: libXpm security update","status":"published","published":"2024-09-16T14:34:47Z","modified":"2026-03-18T11:35:03.830363Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2217","title":"Red Hat Security Advisory: motif security update","status":"published","published":"2024-09-16T14:34:57Z","modified":"2026-03-18T11:33:41.865755Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2974","title":"Red Hat Security Advisory: libXpm security update","status":"published","published":"2024-09-16T14:35:06Z","modified":"2026-03-18T11:31:12.390422Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3022","title":"Red Hat Security Advisory: motif security update","status":"published","published":"2024-09-16T14:35:16Z","modified":"2026-03-18T11:31:00.569576Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2146","title":"Moderate: libXpm security update","description":"X.Org X11 libXpm runtime library.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:09.903227Z","modified":"2025-10-07T17:38:06.759816Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:2217","title":"Moderate: motif security update","description":"The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:09.903227Z","modified":"2025-05-07T20:08:44.658591Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:3022","title":"Moderate: motif security update","description":"The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:44.728485Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-43789","description":"A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.","status":"published","published":"2023-10-03T00:00:00Z","modified":"2026-10-17T12:56:26.045705785Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2146","title":"Moderate: libXpm security update","description":"X.Org X11 libXpm runtime library.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.688526223Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2217","title":"Moderate: motif security update","description":"The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:08.113308419Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2974","title":"Moderate: libXpm security update","description":"X.Org X11 libXpm runtime library.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.448241283Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3022","title":"Moderate: motif security update","description":"The motif packages include the Motif shared libraries needed to run applications which are dynamically linked against Motif, as well as MWM, the Motif Window Manager.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.6905101Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1778167813","title":"libXpm: Fix of 2 CVEs","description":"- CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()\n- CVE-2023-43789: out of bounds read on XPM with corrupted colormap","status":"published","published":"2026-05-07T15:30:18Z","modified":"2026-06-01T00:32:29.646562269Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779823076","title":"motif: Fix of 2 CVEs","description":"- CVE-2023-43788: fix out of bounds read in XpmCreateXpmImageFromBuffer\n- CVE-2023-43789: fix out of bounds read on XPM with corrupted colormap","status":"published","published":"2026-05-26T19:18:00Z","modified":"2026-10-26T09:30:03.920164664Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-3603-1","title":"libxpm - security update","status":"published","published":"2023-10-05T00:00:00Z","modified":"2026-03-09T02:09:50.618142Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5516-1","title":"libxpm - security update","status":"published","published":"2023-10-05T00:00:00Z","modified":"2026-03-09T02:10:24.626542Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0292","title":"Updated libxpm packages fix security vulnerabilities","description":"A vulnerability was found in libXpm due to a boundary condition within\nthe XpmCreateXpmImageFromBuffer() function. This flaw allows a local to\ntrigger an out-of-bounds read error and read the contents of memory on\nthe system. (CVE-2023-43788)\n\nOut of bounds read on XPM with corrupted colormap. (CVE-2023-43789)\n","status":"published","published":"2023-10-20T08:34:20Z","modified":"2026-04-16T04:42:33.851885584Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13297-1","title":"libXpm-devel-3.5.17-1.1 on GA media","description":"These are all security issues fixed in the libXpm-devel-3.5.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:10.248704Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2024:2974","title":"Moderate: libXpm security update","description":"X.Org X11 libXpm runtime library.\n\nSecurity Fix(es):\n\n* libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)\n\n* libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-04T19:00:07.398037Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:3962-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issues:\n\n- CVE-2023-43788: Fixed an out of bounds read when creating an image\n  (bsc#1215686).\n- CVE-2023-43789: Fixed an out of bounds read when parsing an XPM file\n  with a corrupted colormap (bsc#1215687).\n","status":"published","published":"2023-10-04T07:23:30Z","modified":"2026-02-04T04:07:21.72259Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3965-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issues:\n\n- CVE-2023-43788: Fixed an out of bounds read when creating an image\n  (bsc#1215686).\n- CVE-2023-43789: Fixed an out of bounds read when parsing an XPM file\n  with a corrupted colormap (bsc#1215687).\n","status":"published","published":"2023-10-04T07:47:44Z","modified":"2026-02-04T02:35:37.33643Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6408-1","title":"libxpm vulnerabilities","description":"Yair Mizrahi discovered that libXpm incorrectly handled certain malformed\nXPM image files. If a user were tricked into opening a specially crafted\nXPM image file, a remote attacker could possibly use this issue to consume\nmemory, leading to a denial of service. (CVE-2023-43786)\n\nYair Mizrahi discovered that libXpm incorrectly handled certain malformed\nXPM image files. If a user were tricked into opening a specially crafted\nXPM image file, a remote attacker could use this issue to cause libXpm to\ncrash, leading to a denial of service, or possibly execute arbitrary code.\n(CVE-2023-43787)\n\nAlan Coopersmith discovered that libXpm incorrectly handled certain\nmalformed XPM image files. If a user were tricked into opening a specially\ncrafted XPM image file, a remote attacker could possibly use this issue to\ncause libXpm to crash, leading to a denial of service. (CVE-2023-43788,\nCVE-2023-43789)\n","status":"published","published":"2023-10-03T17:06:43Z","modified":"2026-04-27T16:53:04.60168Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6408-2","title":"libxpm vulnerabilities","description":"USN-6408-1 fixed several vulnerabilities in libXpm. This update provides\nthe corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Yair Mizrahi discovered that libXpm incorrectly handled certain malformed\n XPM image files. If a user were tricked into opening a specially crafted\n XPM image file, a remote attacker could possibly use this issue to consume\n memory, leading to a denial of service. (CVE-2023-43786)\n\n Yair Mizrahi discovered that libXpm incorrectly handled certain malformed\n XPM image files. If a user were tricked into opening a specially crafted\n XPM image file, a remote attacker could use this issue to cause libXpm to\n crash, leading to a denial of service, or possibly execute arbitrary code.\n (CVE-2023-43787)\n\n Alan Coopersmith discovered that libXpm incorrectly handled certain\n malformed XPM image files. If a user were tricked into opening a specially\n crafted XPM image file, a remote attacker could possibly use this issue to\n cause libXpm to crash, leading to a denial of service. (CVE-2023-43788,\n CVE-2023-43789)\n","status":"published","published":"2023-10-23T17:39:04Z","modified":"2026-06-29T13:50:58.226811624Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}