RHEL 2.1 / 3 : openmotif (RHSA-2004:537)
Critical Nessus Plugin ID 15943
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionUpdated openmotif packages that fix flaws in the Xpm image library are now available.
OpenMotif provides libraries which implement the Motif industry standard graphical user interface.
During a source code audit, Chris Evans and others discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687, CVE-2004-0688, and CVE-2004-0914 to these issues.
Users of OpenMotif are advised to upgrade to these erratum packages, which contain backported security patches to the embedded libXpm library.
SolutionUpdate the affected openmotif, openmotif-devel and / or openmotif21 packages.