8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.1%
Issue Overview:
A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (CVE-2022-44617)
A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library. (CVE-2022-46285)
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. (CVE-2022-4883)
Affected Packages:
libXpm
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libXpm to update your system.
New Packages:
aarch64:
libXpm-3.5.12-9.amzn2.0.1.aarch64
libXpm-devel-3.5.12-9.amzn2.0.1.aarch64
libXpm-debuginfo-3.5.12-9.amzn2.0.1.aarch64
i686:
libXpm-3.5.12-9.amzn2.0.1.i686
libXpm-devel-3.5.12-9.amzn2.0.1.i686
libXpm-debuginfo-3.5.12-9.amzn2.0.1.i686
src:
libXpm-3.5.12-9.amzn2.0.1.src
x86_64:
libXpm-3.5.12-9.amzn2.0.1.x86_64
libXpm-devel-3.5.12-9.amzn2.0.1.x86_64
libXpm-debuginfo-3.5.12-9.amzn2.0.1.x86_64
Red Hat: CVE-2022-44617, CVE-2022-46285, CVE-2022-4883
Mitre: CVE-2022-44617, CVE-2022-46285, CVE-2022-4883
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 2 | aarch64 | libxpm | < 3.5.12-9.amzn2.0.1 | libXpm-3.5.12-9.amzn2.0.1.aarch64.rpm |
Amazon Linux | 2 | aarch64 | libxpm-devel | < 3.5.12-9.amzn2.0.1 | libXpm-devel-3.5.12-9.amzn2.0.1.aarch64.rpm |
Amazon Linux | 2 | aarch64 | libxpm-debuginfo | < 3.5.12-9.amzn2.0.1 | libXpm-debuginfo-3.5.12-9.amzn2.0.1.aarch64.rpm |
Amazon Linux | 2 | i686 | libxpm | < 3.5.12-9.amzn2.0.1 | libXpm-3.5.12-9.amzn2.0.1.i686.rpm |
Amazon Linux | 2 | i686 | libxpm-devel | < 3.5.12-9.amzn2.0.1 | libXpm-devel-3.5.12-9.amzn2.0.1.i686.rpm |
Amazon Linux | 2 | i686 | libxpm-debuginfo | < 3.5.12-9.amzn2.0.1 | libXpm-debuginfo-3.5.12-9.amzn2.0.1.i686.rpm |
Amazon Linux | 2 | x86_64 | libxpm | < 3.5.12-9.amzn2.0.1 | libXpm-3.5.12-9.amzn2.0.1.x86_64.rpm |
Amazon Linux | 2 | x86_64 | libxpm-devel | < 3.5.12-9.amzn2.0.1 | libXpm-devel-3.5.12-9.amzn2.0.1.x86_64.rpm |
Amazon Linux | 2 | x86_64 | libxpm-debuginfo | < 3.5.12-9.amzn2.0.1 | libXpm-debuginfo-3.5.12-9.amzn2.0.1.x86_64.rpm |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.1%