RHEL 2.1 / 3 : openmotif (RHSA-2004:537)

critical Nessus Plugin ID 15943

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated openmotif packages that fix flaws in the Xpm image library are now available.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

During a source code audit, Chris Evans and others discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687, CVE-2004-0688, and CVE-2004-0914 to these issues.

Users of OpenMotif are advised to upgrade to these erratum packages, which contain backported security patches to the embedded libXpm library.

Solution

Update the affected openmotif, openmotif-devel and / or openmotif21 packages.

Plugin Details

Severity: Critical

ID: 15943

File Name: redhat-RHSA-2004-537.nasl

Version: 1.28

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 12/13/2004

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openmotif, p-cpe:/a:redhat:enterprise_linux:openmotif-devel, p-cpe:/a:redhat:enterprise_linux:openmotif21, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 12/2/2004

Vulnerability Publication Date: 10/20/2004

Reference Information

CVE: CVE-2004-0687, CVE-2004-0688, CVE-2004-0883, CVE-2004-0914, CVE-2004-0949, CVE-2004-1068, CVE-2004-1071, CVE-2004-1072

RHSA: 2004:537

Detections

Analytics