USN-5807-1: libXpm vulnerabilities | Cloud Foundry

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 18.04
• Canonical Ubuntu 22.04

Description

Martin Ettl discovered that libXpm incorrectly handled certain XPM files. If a user or automated system were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-44617) Marco Ivaldi discovered that libXpm incorrectly handled certain XPM files. If a user or automated system were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-46285) Alan Coopersmith discovered that libXpm incorrectly handled calling external helper binaries. If libXpm was being used by a setuid binary, a local attacker could possibly use this issue to escalate privileges. (CVE-2022-4883) Update Instructions: Run sudo pro fix USN-5807-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: xpmutils – 1:3.5.12-1ubuntu0.18.04.2 libxpm-dev – 1:3.5.12-1ubuntu0.18.04.2 libxpm4 – 1:3.5.12-1ubuntu0.18.04.2 No subscription required

CVEs contained in this USN include: CVE-2022-44617, CVE-2022-46285, CVE-2022-4883.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs3

• * All versions prior to 0.351.0
  

• cflinuxfs4

• * All versions prior to 0.57.0
  

• CF Deployment

• * All versions prior to 26.4.0
  

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs3

• * Upgrade all versions to 0.351.0 or greater
  

• cflinuxfs4

• * Upgrade all versions to 0.57.0 or greater
  

• CF Deployment

• * Upgrade all versions to 26.4.0 or greater
  

References

• USN Notice
• CVE-2022-44617
• CVE-2022-46285
• CVE-2022-4883

History

2023-02-24: Initial vulnerability report published.