Detections
Analytics

RHEL 2.1 : lesstif (RHSA-2005:004)

critical Nessus Plugin ID 16144

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An updated lesstif package that fixes flaws in the Xpm library is now available for Red Hat Enterprise Linux 2.1.

LessTif provides libraries which implement the Motif industry standard graphical user interface.

During a source code audit, Chris Evans discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within Lesstif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687,CVE-2004-0688, and CVE-2004-0914 to these issues.

Users of LessTif are advised to upgrade to this erratum package, which contains backported security patches to the embedded libXpm library.

Solution

Update the affected lesstif and / or lesstif-devel packages.

See Also

https://access.redhat.com/security/cve/cve-2004-0687

https://access.redhat.com/security/cve/cve-2004-0688

https://access.redhat.com/security/cve/cve-2004-0914

https://access.redhat.com/errata/RHSA-2005:004

Plugin Details

Severity: Critical

ID: 16144

File Name: redhat-RHSA-2005-004.nasl

Version: 1.25

Type: local

Agent: unix

Published: 1/13/2005

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:lesstif, p-cpe:/a:redhat:enterprise_linux:lesstif-devel, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 1/12/2005

Vulnerability Publication Date: 10/20/2004

Reference Information

CVE: CVE-2004-0687, CVE-2004-0688, CVE-2004-0914

RHSA: 2005:004