CVE-2023-43788

CVE-2023-43788 affects libXpm. The vulnerability stems from a boundary condition in XpmCreateXpmImageFromBuffer(), enabling a local attacker to trigger an out-of-bounds read and read memory contents. Connected advisories confirm the issue across multiple distributions (e.g., AlmaLinux and related...

CVE-2022-44617

The CVE-2022-44617 issue is a Denial of Service in libXpm caused by a parser loop when processing certain XPM inputs (notably width=0 with very large height). Affected packages include libXpm across multiple distributions (Linux vendors show related CVEs 44617/46285/4883). The practical impact is...

CVE-2022-4883

CVE-2022-4883 concerns the libXpm library. When processing files with .Z or .gz extensions, libXpm may invoke external programs to compress/uncompress, using PATH to locate these helpers. This behavior allows a local attacker to cause arbitrary program execution by manipulating PATH. Reported acr...

CVE-2022-46285

The CVE-2022-46285 issue affects libXpm and is caused by failing to detect EOF when parsing a file with an unclosed comment, which can cause an infinite loop and Denial of Service in the host application. Connected sources confirm this vulnerability and commonly reference fixes in libXpm releases...