CVE-2023-43788 — Out-of-bounds Read in Libxpm

CWE-125 — Out-of-bounds Read11 documents9 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 93.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
X.org LibxpmFedoraproject FedoraRedhat Enterprise Linux
Timeline
PublishedOct 10
Latest updateOct 23

Description

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDx.org/libxpm< 3.5.17
▶Debianx.org/libxpm< 1:3.5.12-1.1+deb11u1+3

Also affects: Fedora 37, 38, 39, Enterprise Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-vg9m-f99j-3qwm: A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function↗2023-10-10
▶
CVEList
Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()↗2023-10-10
▶
OSV
CVE-2023-43788: A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function↗2023-10-10
▶

📋Vendor Advisories

7
Ubuntu
libXpm vulnerabilities↗2023-10-23
▶
Microsoft
Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()↗2023-10-10
▶
Red Hat
libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()↗2023-10-04
▶
Ubuntu
libXpm vulnerabilities↗2023-10-03
▶
BSD
OpenBSD 7.2 Errata 039: SECURITY FIX↗2023-10-03
▶
CVE-2023-43788 — Out-of-bounds Read in X.org Libxpm | cvebase