RHEL 2.1 / 3 : openmotif (RHSA-2004:537)

Critical Nessus Plugin ID 15943

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated openmotif packages that fix flaws in the Xpm image library are now available.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

During a source code audit, Chris Evans and others discovered several stack overflow flaws and an integer overflow flaw in the libXpm library used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0687, CVE-2004-0688, and CVE-2004-0914 to these issues.

Users of OpenMotif are advised to upgrade to these erratum packages, which contain backported security patches to the embedded libXpm library.

Solution

Update the affected openmotif, openmotif-devel and / or openmotif21 packages.

See Also

https://access.redhat.com/security/cve/cve-2004-0687

https://access.redhat.com/security/cve/cve-2004-0688

https://access.redhat.com/security/cve/cve-2004-0914

https://access.redhat.com/errata/RHSA-2004:537

Plugin Details

Severity: Critical

ID: 15943

File Name: redhat-RHSA-2004-537.nasl

Version: 1.27

Type: local

Agent: unix

Published: 2004/12/13

Updated: 2019/10/25

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openmotif, p-cpe:/a:redhat:enterprise_linux:openmotif-devel, p-cpe:/a:redhat:enterprise_linux:openmotif21, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 2004/12/02

Vulnerability Publication Date: 2004/10/20

Reference Information

CVE: CVE-2004-0687, CVE-2004-0688, CVE-2004-0883, CVE-2004-0914, CVE-2004-0949, CVE-2004-1068, CVE-2004-1071, CVE-2004-1072

RHSA: 2004:537