JLSEC-2026-285

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...

PT-2026-39170

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...

PT-2026-39171

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system...

PT-2026-39172

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system...

PT-2026-39168

A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library...

PT-2026-39169

A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library...

libXpm-devel-3.5.18-2.1 on GA media (moderate)

libXpm-devel-3.5.18-2.1 on GA media Announcement ID: openSUSE-SU-2026:10608-1 Rating: moderate Cross-References: CVE-2026-4367 CVSS scores: CVE-2026-4367 SUSE : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2026-4367 SUSE : 5.8 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:...

OPENSUSE-SU-2026:10608-1 libXpm-devel-3.5.18-2.1 on GA media

These are all security issues fixed in the libXpm-devel-3.5.18-2.1 package on the GA media of openSUSE Tumbleweed...

[slackware-security] libXpm

New libXpm packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXpm-3.5.19-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Out-of-bounds read in xpmNextWord. For more...

Slackware Linux 15.0 / current libXpm Vulnerability (SSA:2026-111-01)

The version of libXpm installed on the remote host is prior to 3.5.19. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-111-01 advisory. New libXpm packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

X.Org libXpm security vulnerabilities

X.Org libXpm is a graphics processing library developed by the X.Org Foundation. X.Org libXpm has a security vulnerability that stems from the xpmNextWord function’s ability to read memory segments, which may lead to the extraction of sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2026-4367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord function by processing a...

UBUNTU-CVE-2026-4367

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord function by processing a specially crafted or very small XPM X PixMap image file. This improper validation of file boundaries can cause an internal pointer to read...

CVE-2026-4367

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord function by processing a specially crafted or very small XPM X PixMap image file. This improper validation of file boundaries can cause an internal pointer to read...

PT-2026-34870

Name of the Vulnerable Software and Affected Versions libXpm versions prior to 3.5.18-2.1 Description An issue exists in the image parsing functionality of libXpm. Recommendations Update to version 3.5.18-2.1...

MiracleLinux 8 : libXpm-3.5.12-9.el8 (AXSA:2023-4843:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4843:01 advisory. libXpm: compression commands depend on $PATH CVE-2022-4883 libXpm: Runaway loop on width of 0 and enormous height CVE-2022-44617 libXpm: Infinite lo...

MiracleLinux 8 : libXpm-3.5.12-11.el8 (AXSA:2024-8338:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8338:02 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer CVE-2023-43788 libXpm: out of bounds read on XPM with corrupted colormap CVE-2023-43789...

MiracleLinux 9 : motif-2.3.4-28.el9 (AXSA:2024-7932:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7932:01 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer CVE-2023-43788 libXpm: out of bounds read on XPM with corrupted colormap CVE-2023-43789...

MiracleLinux 7 : libXpm-3.5.12-2.el7 (AXSA:2023-4845:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4845:02 advisory. libXpm: compression commands depend on $PATH CVE-2022-4883 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 9 : libXpm-3.5.13-10.el9 (AXSA:2024-7916:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7916:01 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer CVE-2023-43788 libXpm: out of bounds read on XPM with corrupted colormap CVE-2023-43789...