SB2023011734 - Multiple vulnerabilities in libxpm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023011734

SB2023011734 - Multiple vulnerabilities in libxpm

Published: January 17, 2023 Updated: January 24, 2023

Security Bulletin ID SB2023011734
Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Untrusted search path (CVE-ID: CVE-2022-4883)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to libXpm relies on the $PATH variable to run the command responsible for decompressing .Z or .gz files. A local user can execute arbitrary code with elevated privileges.


2) Infinite loop (CVE-ID: CVE-2022-44617)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the ParsePixels() function when handling XPM files with width set to 0 and a very large height value. A remote attacker can trick the victim to open a specially crafted XPM file and perform a denial of service (DoS) attack.


3) Infinite loop (CVE-ID: CVE-2022-46285)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when handling unclosed comments in XPM images within the ParseComment() function. A remote attacker can trick the victim to open a specially crafted image and cause denial of service conditions.


4) Information disclosure (CVE-ID: CVE-2023-24040)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to insufficient input validation within the parser of lpstat in dtprintinfo. A local user can inject arbitrary printer names via the $HOME/.printers file, manipulate the control flow and disclose memory contents on Solaris 10 systems.


5) Stack-based buffer overflow (CVE-ID: CVE-2023-24039)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in ParseColors(). A local user can trigger a stack-based buffer overflow and execute arbitrary code with root privileges on the Solaris 10 system via the dtprintinfo setuid binary.


Remediation

Install update from vendor's website.

References