libXpm XPM image multiple buffer overflows
| libxpm-multiple-stack-bo (17414) |  High Risk |
Description:
libXpm is vulnerable to a stack-based buffer overflow in the xpmParseColors, ParseAndPutPixels, and ParsePixels functions. By creating a specially-crafted XPM file, a remote attacker could cause the program to crash or possibly execute arbitrary code on the system.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Debian, Debian Linux 3.0
- Gentoo, Linux
- HP, HP-UX B.11.00
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 2006 X86_64
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux LE2005
- MandrakeSoft, Mandrake Linux LE2005 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- RedHat, Enterprise Linux 2.1 AW
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- RedHat, Network Satellite Server 4.2
- Sun, JDS 2003
- Sun, JDS Release 2
- Sun, Solaris 8
- Sun, Solaris 9
- SuSE, Linux Enterprise Server 8
- SuSE, Linux Enterprise Server 9
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux 8.2
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.1
- SuSE, SuSE Linux Desktop 1.0
- SuSE, SuSE SLES 9
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Home
- X.Org, libXpm prior to 6.8.1
Remedy:
Upgrade to the latest version of libXpm (6.8.1 or later), available from the X.org Web site. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Mon May 22 2006 - 08:38:14 CDT, [security bulletin] HPSBUX02119 SSRT4848 rev.1 - HP-UX Running Motif Applications Remote Arbitrary Code Execution, Denial of Service (DoS) at http://archives.neohapsis.com/archives/bugtraq/2006-05/0432.html.
- CIAC Information Bulletin 0-216, "gtk2" Package Vulnerability at http://www.ciac.org/ciac/bulletins/o-216.shtml.
- CIAC Information Bulletin 0-217, "gdk-pixbuf" Package vulnerability at http://www.ciac.org/ciac/bulletins/o-217.shtml.
- CIAC Information Bulletin 0-222, libXpm Library Contains Multiple Integer Overflow Vulnerabilities at http://www.ciac.org/ciac/bulletins/o-222.shtml.
- CIAC Information Bulletin P-001, Red Hat Updated XFree86 Packages fix Security Issues at http://www.ciac.org/ciac/bulletins/p-001.shtml.
- CIAC Information Bulletin P-052, Updated imlib Packages Fix Security Vulnerabilities at http://www.ciac.org/ciac/bulletins/p-052.shtml.
- CIAC Information Bulletin P-069, Sun - Multiple Mozilla Vulnerabilities at http://www.ciac.org/ciac/bulletins/p-069.shtml.
- CIAC INFORMATION BULLETIN P-200, Apple Security Update 2005-005 at http://www.ciac.org/ciac/bulletins/p-200.shtml.
- Hewlett-Packard Company Security Bulletin HPSBUX02119 SSRT4848, HP-UX Running Motif Applications Remote Arbitrary Code Execution, Denial of Service (DoS) at http://h20000.www2.hp.com/bizsup.../Document.jsp?objectID=c00600177.
- Scary Beasts Security Advisory CESA-2004-003, libXpm multiple image parsing flaws at http://scary.beasts.org/security/CESA-2004-003.txt.
- Sun Alert ID: 57652, Security Vulnerabilities in libXpm May Allow a Remote Unpriviledged User to Execute Arbitrary Code at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57652-1&searchclause=%22category:security%22%20%22availability,%20security%22.
- Sun Alert ID: 57653, libXpm Security Vulnerabilities Affect the Motif Library (libXm) at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57653-1&searchclause=.
- Sun Alert ID: 57701, Multiple Security Vulnerabilities in Mozilla at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57701-1&searchclause=%22category:security%22%20%22availability,%20security%22.
- X.org Web site, X.org at http://www.x.org/.
- BID-11195: GDK-Pixbuf Multiple Vulnerabilities
- BID-11196: libXpm Image Decoding Multiple Remote Buffer Overflow Vulnerabilities
- BID-11830: IMLib Multiple XPM Image Decoding Buffer Overflow Vulnerabilities
- CVE-2004-0687: Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.
- CVE-2004-0783: Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
- DSA-549: gtk+ -- several vulnerabilities
- DSA-560: lesstif1-1 -- integer and stack overflows
- DSA-561: xfree86 -- integer and stack overflows
- GLSA-200409-28: GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities
- GLSA-200409-34: X.org, XFree86: Integer and stack overflows in libXpm
- GLSA-200410-09: LessTif: Integer and stack overflows in libXpm
- GLSA-200502-07: OpenMotif: Multiple vulnerabilities in libXpm
- MDKSA-2004:095: Updated gdk-pixbuf packages fix image loading vulnerabilities
- MDKSA-2004:095-1: Updated gdk-pixbuf and gtk+2 packages fix image loading vulnerabilities
- MDKSA-2004:098: Updated libxpm4 packages fix libXpm overflow vulnerabilities
- MDKSA-2004:099: Updated XFree86 packages fix libXpm overflow vulnerabilities
- MDKSA-2004:124: Updated xorg-x11 packages fix libXpm overflow vulnerabilities
- MDKSA-2005:214: Updated gdk-pixbuf/gtk+2.0 packages fix vulnerability
- OSVDB ID: 10027: libXpm ParsePixels Function Stack Overflow
- OSVDB ID: 10028: libXpm xpmParseColors Function XPMv1 Parsing Stack Overflow
- OSVDB ID: 10029: libXpm xpmParseColors Function XPMv2/3 Parsing Stack Overflow
- OSVDB ID: 10034: libXpm ParseAndPutPixels Function Stack Overflow
- RHSA-2004-447: gdk-pixbuf security update
- RHSA-2004-466: gtk2 security update
- RHSA-2004-478: XFree86 security update
- RHSA-2004-479: XFree86 security update
- RHSA-2004-537: openmotif security update
- RHSA-2005-004: lesstif security update
- RHSA-2008-0524: Low: Red Hat Network Satellite Server security update
- SA20235: HP-UX Motif Applications libXpm Image Decoding Vulnerabilities
- SUSE-SA:2004:032: apache2: remote denial-of-service
- SUSE-SA:2004:033: gtk2 gdk-pixbuf: remote code execution
- SUSE-SA:2004:034: XFree86-libs xshared: remote command execution
Reported:
Sep 16, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net