scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.

SunOS 5.10_x86: libXpm patch.
Date this patch was last updated by Sun : May/12/05

SunOS 5.10: libXpm patch.
Date this patch was last updated by Sun : May/12/05

Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

During an internal security review, a cross-site scripting flaw was found that affected the Red Hat Network channel search feature.
(CVE-2007-5961)

This release also corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Two arbitrary code execution flaws were fixed in the OpenMotif package. (CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues.

Updated xorg-x11 packages that fix a security issue as well as various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

X.Org X11 is the X Window System which provides the core functionality of the Linux GUI desktop.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with libXpm to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Since the initial release of Red Hat Enterprise Linux 4, a number of issues have been addressed in the X.Org X11 X Window System. This erratum also updates X11R6.8 to the latest stable point release (6.8.2), which includes various stability and reliability fixes including (but not limited to) the following :

  - The 'radeon' driver has been modified to disable     'RENDER' acceleration by default, due to a bug in the     implementation which has not yet been isolated. This can     be manually re-enabled by using the following option in     the device section of the X server config file :

Option 'RenderAccel'

  - The 'vmware' video driver is now available on 64-bit     AMD64 and compatible systems.

  - The Intel 'i810' video driver is now available on 64-bit     EM64T systems.

  - Stability fixes in the X Server's PCI handling layer for     64-bit systems, which resolve some issues reported by     'vesa' and 'nv' driver users.

  - Support for Hewlett Packard's Itanium ZX2 chipset.

  - Nvidia 'nv' video driver update provides support for     some of the newer Nvidia chipsets, as well as many     stability and reliability fixes.

  - Intel i810 video driver stability update, which fixes     the widely reported i810/i815 screen refresh issues many     have experienced.

  - Packaging fixes for multilib systems, which permit both     32-bit and 64-bit X11 development environments to be     simultaneously installed without file conflicts.

In addition to the above highlights, the X.Org X11 6.8.2 release has a large number of additional stability fixes which resolve various other issues reported since the initial release of Red Hat Enterprise Linux 4.

All users of X11 should upgrade to these updated packages, which resolve these issues.

Updated openmotif packages that fix a flaw in the Xpm image library are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

An integer overflow flaw was found in libXpm, which is used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Users of OpenMotif are advised to upgrade to these erratum packages, which contains a backported security patch to the embedded libXpm library.

Updated XFree86 packages that fix a libXpm integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XFree86 is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

The updated XFree86 packages also address the following minor issues :

  - Updated     XFree86-4.3.0-keyboard-disable-ioport-access-v3.patch to     make warning messages less alarmist.

  - Backported XFree86-4.3.0-libX11-stack-overflow.patch     from xorg-x11-6.8.1 packaging to fix stack overflow in     libX11, which was discovered by new security features of     gcc4.

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Chris Gilbert discovered a buffer overflow in the XPM library shipped with XFree86. If an attacker tricked a user into loading a malicious XPM image with an application that uses libxpm, he could exploit this to execute arbitrary code with the privileges of the user opening the image.

These overflows do not allow privilege escalation through the X server; the overflows are in a client-side library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in the XPM image decoding functions of the LessTif library. If an attacker tricked a user into loading a malicious XPM image with an application that uses LessTif, he could exploit this to execute arbitrary code in the context of the user opening the image.

Ubuntu does not contain any server applications using LessTif, so there is no possibility of privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Furthermore, this updates the Fedora Core 3 X.org packages to the 6.8.2 maintenance release, which includes a large number of bug fixes :

http://xorg.freedesktop.org/wiki/X11R682Release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

Updated lesstif packages that fix flaws in the Xpm library are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having Moderate security impact by the Red Hat Security Response Team.

LessTif provides libraries which implement the Motif industry standard graphical user interface.

An integer overflow flaw was found in libXpm; a vulnerable version of this library is found within LessTif. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to LessTif. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Users of LessTif should upgrade to these updated packages, which contain a backported patch to correct this issue.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.

The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.

An integer overflow flaw was found in libXPM, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code via a negative bitmap_unit value if opened by a victim using an application linked to the vulnerable library.

Updated packages are patched to correct all these issues.

A buffer overflow has been discovered in the Xpm library which is used in XFree86. A remote attacker could provide a specially crafted XPM image that could lead to the execution of arbitrary code.

The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files.

An integer overflow flaw was found in libXPM, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code via a negative bitmap_unit value if opened by a victim using an application linked to the vulnerable library.

Updated packages are patched to correct all these issues.

Updated XFree86 packages that fix a libXpm integer overflow flaw and a number of bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full-fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

XFree86 4.1.0 was not functional on systems that did not have a legacy keyboard controller (8042). During startup, the X server would attempt to update registers on the 8042 controller, but if that chip was not present, the X server would hang during startup. This new release has a workaround so that the access to those registers time out if they are not present.

A bug in libXaw could cause applications to segfault on 64-bit systems under certain circumstances. This has been fixed with a patch backported from XFree86 4.3.0.

Xlib contained a memory leak caused by double allocation, which has been fixed in XFree86 4.3.0 using backported patch.

All users of XFree86 should upgrade to these updated packages, which resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200503-15 (X.org: libXpm vulnerability)

    Chris Gilbert has discovered potentially exploitable buffer overflow     cases in libXpm that weren't fixed in previous libXpm versions.
  Impact :

    A carefully-crafted XPM file could crash X.org, potentially allowing     the execution of arbitrary code with the privileges of the user running     the application.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200503-08 (OpenMotif, LessTif: New libXpm buffer overflows)

    Chris Gilbert discovered potentially exploitable buffer overflow     cases in libXpm that weren't fixed in previous libXpm security     advisories.
  Impact :

    A carefully-crafted XPM file could crash applications making use     of the OpenMotif or LessTif toolkits, potentially allowing the     execution of arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
107807	Solaris 10 (x86) : 119064-01	Nessus	Solaris Local Security Checks	high
107305	Solaris 10 (sparc) : 119063-01	Nessus	Solaris Local Security Checks	high
43837	RHEL 3 / 4 : Satellite Server (RHSA-2008:0524)	Nessus	Red Hat Local Security Checks	critical
43835	RHEL 4 : Satellite Server (RHSA-2008:0261)	Nessus	Red Hat Local Security Checks	critical
21921	CentOS 4 : xorg-x11 (CESA-2005:198)	Nessus	CentOS Local Security Checks	high
21820	CentOS 3 / 4 : openmotif (CESA-2005:412)	Nessus	CentOS Local Security Checks	high
21804	CentOS 3 : XFree86 (CESA-2005:331)	Nessus	CentOS Local Security Checks	high
20723	Ubuntu 4.10 : xfree86 vulnerability (USN-97-1)	Nessus	Ubuntu Local Security Checks	high
20718	Ubuntu 4.10 : lesstif1-1 vulnerabilities (USN-92-1)	Nessus	Ubuntu Local Security Checks	high
19641	Fedora Core 3 : xorg-x11-6.8.2-1.FC3.13 (2005-273)	Nessus	Fedora Local Security Checks	high
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
18443	RHEL 4 : xorg-x11 (RHSA-2005:198)	Nessus	Red Hat Local Security Checks	high
18390	RHEL 2.1 : lesstif (RHSA-2005:473)	Nessus	Red Hat Local Security Checks	high
18328	Fedora Core 2 : xorg-x11-6.7.0-14 (2005-272)	Nessus	Fedora Local Security Checks	high
18253	RHEL 2.1 / 3 / 4 : openmotif (RHSA-2005:412)	Nessus	Red Hat Local Security Checks	high
18235	Mandrake Linux Security Advisory : XFree86 (MDKSA-2005:081)	Nessus	Mandriva Local Security Checks	high
18227	Debian DSA-723-1 : xfree86 - buffer overflow	Nessus	Debian Local Security Checks	high
18173	Mandrake Linux Security Advisory : xpm (MDKSA-2005:080)	Nessus	Mandriva Local Security Checks	high
17994	RHEL 2.1 : XFree86 (RHSA-2005:044)	Nessus	Red Hat Local Security Checks	high
17660	RHEL 3 : XFree86 (RHSA-2005:331)	Nessus	Red Hat Local Security Checks	high
17317	GLSA-200503-15 : X.org: libXpm vulnerability	Nessus	Gentoo Local Security Checks	high
17274	GLSA-200503-08 : OpenMotif, LessTif: New libXpm buffer overflows	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0605

critical

Tenable Plugins

high

high

critical

critical

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high