Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.

Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

USN-83-1 fixed some vulnerabilities in the 'lesstif2' library. The older 'lesstif1' library was also affected, however, a fix was not yet available at that time. This USN fixes the flaws for lesstif1.

Please note that there are no supported applications that use this library, so this only affects you if you use third-party applications which use lesstif1.

For your convenience, here is the relevant part of the USN-83-1 description :

Several vulnerabilities have been found in the XPM image decoding functions of the LessTif library. If an attacker tricked a user into loading a malicious XPM image with an application that uses LessTif, he could exploit this to execute arbitrary code in the context of the user opening the image.

Ubuntu does not contain any server applications using LessTif, so there is no possibility of privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in the XPM image decoding functions of the LessTif library. If an attacker tricked a user into loading a malicious XPM image with an application that uses LessTif, he could exploit this to execute arbitrary code in the context of the user opening the image.

Ubuntu does not contain any server applications using LessTif, so there is no possibility of privilege escalation.

Please note that this update only fixes lesstif2. The older lesstif1 version is also affected. A proper fix for lesstif1 will still take some time and will be done in a separate USN. However, no Ubuntu application uses lesstif1, so this could only affect you if you use third-party software which depends on this library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Trevor Johnson reported that the Red Hat Linux RPMs used by linux_base contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host is affected by the vulnerability described in GLSA-200502-07 (OpenMotif: Multiple vulnerabilities in libXpm)

    Multiple vulnerabilities, such as buffer overflows, out of bounds     memory access or directory traversals, have been discovered in libXpm     that is shipped as a part of the X Window System (see GLSA 200409-34     and 200411-28). OpenMotif, an application that includes this library,     suffers from the same issues.
  Impact :

    A carefully-crafted XPM file could crash applications making use of the     OpenMotif toolkit, potentially allowing the execution of arbitrary code     with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200502-06 (LessTif: Multiple vulnerabilities in libXpm)

    Multiple vulnerabilities, including buffer overflows, out of     bounds memory access and directory traversals, have been discovered in     libXpm, which is shipped as a part of the X Window System. LessTif, an     application that includes libXpm, suffers from the same issues.
  Impact :

    A carefully-crafted XPM file could crash applications making use     of the LessTif toolkit, potentially allowing the execution of arbitrary     code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

An updated lesstif package that fixes flaws in the Xpm library is now available for Red Hat Enterprise Linux 2.1.

LessTif provides libraries which implement the Motif industry standard graphical user interface.

During a source code audit, Chris Evans discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within Lesstif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687,CVE-2004-0688, and CVE-2004-0914 to these issues.

Users of LessTif are advised to upgrade to this erratum package, which contains backported security patches to the embedded libXpm library.

Updated XFree86 packages that fix several security flaws in libXpm are now available for Red Hat Enterprise Linux 3.

XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon.

Several integer overflow flaws in the X.Org libXpm library used to decode XPM (X PixMap) images have been found and addressed. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0914 to this issue.

Users are advised to upgrade to these erratum packages, which contain backported security patches as well as other bug fixes.

Updated XFree86 packages that fix several security flaws in libXpm are now available for Red Hat Enterprise Linux 2.1.

XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user interfaces (GUIs), such as GNOME and KDE are designed upon.

Several integer overflow flaws in the X.Org libXpm library used to decode XPM (X PixMap) images have been found and addressed. An attacker could create a carefully crafted XP file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0914 to this issue.

Users are advised to upgrade to these erratum packages, which contain backported security patches and other bug fixes.

Updated openmotif packages that fix flaws in the Xpm image library are now available.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

During a source code audit, Chris Evans and others discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687, CVE-2004-0688, and CVE-2004-0914 to these issues.

Users of OpenMotif are advised to upgrade to these erratum packages, which contain backported security patches to the embedded libXpm library.

Several developers have discovered a number of problems in the libXpm library which is provided by X.Org, XFree86 and LessTif. These bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges, by using a specially crafted XPM image.

The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.

A source code review of the XPM library, done by Thomas Biege of the SuSE Security-Team revealed several different kinds of bugs. These bugs include integer overflows, out-of-bounds memory access, shell command execution, path traversal, and endless loops.

These bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges, by using a specially crafted xpm image.

Updated packages are patched to correct all these issues.

The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.

A source code review of the XPM library, done by Thomas Biege of the SuSE Security-Team revealed several different kinds of bugs. These bugs include integer overflows, out-of-bounds memory access, shell command execution, path traversal, and endless loops.

These bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges, by using a specially crafted xpm image.

Update :

The previous libxpm4 update had a linking error that resulted in a missing s_popen symbol error running applications dependent on the library. In addition, the file path checking in the security updates prevented some applications, like gimp-2.0 from being able to save xpm format images.

Updated packages are patched to correct all these issues.

The remote host is affected by the vulnerability described in GLSA-200411-28 (X.Org, XFree86: libXpm vulnerabilities)

    Several issues were discovered in libXpm, including integer     overflows, out-of-bounds memory accesses, insecure path traversal and     an endless loop.
  Impact :

    An attacker could craft a malicious pixmap file and entice a user     to use it with an application linked against libXpm. This could lead to     Denial of Service or arbitrary code execution.
  Workaround :

    There is no known workaround at this time.

The remote host is missing the patch for the advisory SUSE-SA:2004:041 (xshared, XFree86-libs, xorg-x11-libs).


The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.
A source code review done by Thomas Biege of the SuSE Security-Team revealed several different kinds of bugs.
The bug types are:
- integer overflows
- out-of-bounds memory access
- shell command execution
- path traversal
- endless loops By providing a special image these bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges.

Several integer overflow flaws in the X.Org libXpm library used to decode XPM (X PixMap) images have been found and addressed. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0914 to this issue.

Users are advised to upgrade to these erratum packages, which contain backported security patches as well as other bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN

ID	Name	Product	Family	Severity
43837	RHEL 3 / 4 : Satellite Server (RHSA-2008:0524)	Nessus	Red Hat Local Security Checks	critical
20708	Ubuntu 4.10 : lesstif1-1 vulnerabilities (USN-83-2)	Nessus	Ubuntu Local Security Checks	critical
20707	Ubuntu 4.10 : lesstif1-1 vulnerabilities (USN-83-1)	Nessus	Ubuntu Local Security Checks	critical
19106	FreeBSD : linux_base -- vulnerabilities in Red Hat 7.1 libraries (bf2e7483-d3fa-440d-8c6e-8f1f2f018818)	Nessus	FreeBSD Local Security Checks	critical
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	high
16444	GLSA-200502-07 : OpenMotif: Multiple vulnerabilities in libXpm	Nessus	Gentoo Local Security Checks	critical
16443	GLSA-200502-06 : LessTif: Multiple vulnerabilities in libXpm	Nessus	Gentoo Local Security Checks	critical
16144	RHEL 2.1 : lesstif (RHSA-2005:004)	Nessus	Red Hat Local Security Checks	critical
16019	RHEL 3 : XFree86 (RHSA-2004:612)	Nessus	Red Hat Local Security Checks	critical
16009	RHEL 2.1 : XFree86 (RHSA-2004:610)	Nessus	Red Hat Local Security Checks	critical
15943	RHEL 2.1 / 3 : openmotif (RHSA-2004:537)	Nessus	Red Hat Local Security Checks	critical
15932	Debian DSA-607-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
15794	Mandrake Linux Security Advisory : XFree86 (MDKSA-2004:138)	Nessus	Mandriva Local Security Checks	critical
15793	Mandrake Linux Security Advisory : libxpm4 (MDKSA-2004:137-1)	Nessus	Mandriva Local Security Checks	critical
15776	GLSA-200411-28 : X.Org, XFree86: libXpm vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15755	SUSE-SA:2004:041: xshared, XFree86-libs, xorg-x11-libs	Nessus	SuSE Local Security Checks	critical
15748	Fedora Core 3 : xorg-x11-6.8.1-12.FC3.1 (2004-434)	Nessus	Fedora Local Security Checks	critical
15747	Fedora Core 2 : xorg-x11-6.7.0-10 (2004-433)	Nessus	Fedora Local Security Checks	critical
800799	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0914

critical

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high