The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0171-1 advisory.

    - CVE-2022-46285: Fixed an infinite loop that could be triggered       when reading a XPM image with a C-style comment that is never       closed (bsc#1207029).
    - CVE-2022-44617: Fixed an excessive resource consumption that could       be triggered when reading small crafted XPM image (bsc#1207030).
    - CVE-2022-4883: Fixed an issue that made decompression commands       susceptible to PATH environment variable manipulation attacks       (bsc#1207031).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libXpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libXpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3459 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3459-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Bastien Roucaris     June 20, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libxpm     Version        : 1:3.5.12-1+deb10u1     CVE ID         : CVE-2022-4883 CVE-2022-44617 CVE-2022-46285

    libxpm is a library handling X PixMap image format (so called xpm files).
    xpm files are an extension of the monochrome X BitMap format specified     in the X protocol, and is commonly used in traditional X applications.

    CVE-2022-4883

        When processing files with         .Z or .gz extensions, the library calls external programs         to compress and uncompress files, relying on the         PATH environment variable to find these programs,         which could allow a malicious user to execute other programs         by manipulating the PATH environment variable.

    CVE-2022-44617

        When processing a file with width of 0         and a very large height, some parser functions will be         called repeatedly and can lead to an infinite loop,         resulting in a Denial of Service in the application linked         to the library.

    CVE-2022-46285

        When parsing a file with a comment         not closed, an end-of-file condition will not be detected,         leading to an infinite loop and resulting in a         Denial of Service in the application linked to the library.

    For Debian 10 buster, these problems have been fixed in version     1:3.5.12-1+deb10u1.

    We recommend that you upgrade your libxpm packages.

    For the detailed security status of libxpm please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxpm

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-03 (libXpm: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libXpm. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0016 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-46285:
      A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library.

      CVE-2022-44617:
      A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library.

      CVE-2022-4883:
      A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5006:03 advisory.

    * libXpm: compression commands depend on $PATH (CVE-2022-4883)
      * libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)
      * libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170706	SUSE SLED15: libXpm-devel / libXpm-devel-32bit / libXpm-tools / libXpm4 / etc (SUSE-SU-2023:0171-1)	Nessus	SuSE Local Security Checks	1/27/2023	6/26/2026	high
175767	EulerOS Virtualization 2.10.0 : libXpm (EulerOS-SA-2023-1937)	Nessus	Huawei Local Security Checks	5/16/2023	5/16/2023	high
177076	EulerOS 2.0 SP5 : libXpm (EulerOS-SA-2023-2158)	Nessus	Huawei Local Security Checks	6/9/2023	6/9/2023	high
177152	EulerOS Virtualization 3.0.6.0 : libXpm (EulerOS-SA-2023-2253)	Nessus	Huawei Local Security Checks	6/13/2023	6/13/2023	high
177457	Debian dla-3459 : libxpm-dev - security update	Nessus	Debian Local Security Checks	6/20/2023	1/22/2025	high
178898	EulerOS Virtualization 3.0.6.6 : libXpm (EulerOS-SA-2023-2430)	Nessus	Huawei Local Security Checks	7/26/2023	7/26/2023	high
205135	GLSA-202408-03 : libXpm: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/7/2024	8/7/2024	high
238877	TencentOS Server 3: libXpm (TSSA-2023:0016)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
293553	MiracleLinux 9 : libXpm-3.5.13-8.el9 (AXSA:2023-5006:03)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high