Detections
Analytics
Alpine: multiple libxpm packages: security update to 3.5.15-r0
high Tenable Self-Hosted Container Security Plugin ID 424097
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external
programs to compress and uncompress files, relying on the PATH environment variable to find these
programs, which could allow a malicious user to execute other programs by manipulating the PATH
environment variable. (CVE-2022-4883)
- A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser
functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in
the application linked to the library. (CVE-2022-44617)
- A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-
file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in
the application linked to the library. (CVE-2022-46285)
See Also
https://security.alpinelinux.org/vuln/CVE-2022-44617
Plugin Details
Severity: High
ID: 424097
Version: Revision 1.11
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.65
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2022-4883
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 1/17/2023