Published: 20/10/2004 Updated: 20/01/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm prior to 6.8.1 allow remote malicious users to execute arbitrary code via a malformed XPM image file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xfree86 project x11r6 4.1.0
xfree86 project x11r6 3.3.6
xfree86 project x11r6 4.0.2.11
xfree86 project x11r6 4.0.3
x.org x11r6 6.7.0
xfree86 project x11r6 4.3.0
xfree86 project x11r6 4.2.1
x.org x11r6 6.8
xfree86 project x11r6 4.0
xfree86 project x11r6 4.0.1
xfree86 project x11r6 4.2.0
xfree86 project x11r6 4.1.12
xfree86 project x11r6 4.1.11
suse suse linux 9.0
suse suse linux 8.2
suse suse linux 8
suse suse linux 9.1
openbsd openbsd 3.5
openbsd openbsd 3.4
suse suse linux 8.1

Chris Evans discovered several stack overflows in the versions of libXpm shipped by XOrg, XFree86, and LessTif These overflows were fixed in the Warty development tree before its release Mathieu Herrb of OpenBSD subsequently discovered that the original patch was insufficient to address these overflows, and thus the version of libxpm4 shipped w ...

Synopsis XFree86 security update Type/Severity Security Advisory: Moderate Topic Updated XFree86 packages that fix several security issues in libXpm, aswell as other bug fixes, are now available for Red Hat Enterprise Linux 21 Description XFree86 is an open source implementation of the X ...

Synopsis XFree86 security update Type/Severity Security Advisory: Moderate Topic Updated XFree86 packages that fix several security flaws in libXpm,as well as other bugs, are now available for Red Hat Enterprise Linux 3 Description XFree86 is an open source implementation of the X Window S ...

Synopsis openmotif security update Type/Severity Security Advisory: Important Topic Updated openmotif packages that fix flaws in the Xpm image library are nowavailable Description OpenMotif provides libraries which implement the Motif industry standardgraphical user interface During a so ...

Chris Evans discovered several stack and integer overflows in the libXpm library which is provided by XOrg, XFree86 and LessTif For the stable distribution (woody) this problem has been fixed in version 410-16woody4 For the unstable distribution (sid) this problem has been fixed in version 430dfsg1-8 We recommend that you upgrade your lib ...

Chris Evans discovered several stack and integer overflows in the libXpm library which is included in LessTif For the stable distribution (woody) this problem has been fixed in version 09318-5 For the unstable distribution (sid) this problem has been fixed in version 09394-10 We recommend that you upgrade your lesstif packages ...

Multiple vulnerabilities have been discovered across Common Desktop Environment version 16, Motif version 21, and XOrg libXpm versions prior to 3515 on Oracle Solaris 10 that can be chained together to achieve root ...

NVD-CWE-Other http://www.securityfocus.com/bid/11196 http://scary.beasts.org/security/CESA-2004-003.txt http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch http://www.debian.org/security/2004/dsa-560 http://www.gentoo.org/security/en/glsa/glsa-200409-34.xml http://www.gentoo.org/security/en/glsa/glsa-200502-07.xml http://www.redhat.com/support/errata/RHSA-2004-537.html http://www.redhat.com/support/errata/RHSA-2005-004.html http://www.novell.com/linux/security/advisories/2004_34_xfree86_libs_xshared.html http://www.kb.cert.org/vuls/id/882750 http://lists.apple.com/archives/security-announce/2005/May/msg00001.html http://www.us-cert.gov/cas/techalerts/TA05-136A.html http://www.redhat.com/archives/fedora-legacy-announce/2006-January/msg00001.html http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924 http://sunsolve.sun.com/search/document.do?assetkey=1-26-57653-1 http://secunia.com/advisories/20235 http://www.mandriva.com/security/advisories?name=MDKSA-2004:098 http://www.vupen.com/english/advisories/2006/1914 http://marc.info/?l=bugtraq&m=109530851323415&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/17414 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9187 https://usn.ubuntu.com/27-1/http://www.securityfocus.com/archive/1/434715/100/0/threaded http://packetstormsecurity.com/files/170620/Solaris-10-dtprintinfo-libXm-libXpm-Security-Issues.html https://usn.ubuntu.com/27-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/882750

CVE-2004-0687

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect