Log in Start free

Vulnerability · Published Oct 12, 2023 · Assigned by redhat

CVE-2023-43789Libxpm: out of bounds read on xpm with corrupted colormap

Medium 5.5

In plain English

A medium-severity out-of-bounds read in libXpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libXpm3.5.12-11.el8ALSA-2024:2974
AlmaLinux:9libXpm3.5.13-10.el9ALSA-2024:2146
AlmaLinux:8libXpm-devel3.5.12-11.el8ALSA-2024:2974
AlmaLinux:9libXpm-devel3.5.13-10.el9ALSA-2024:2146
AlmaLinux:8motif2.3.4-20.el8ALSA-2024:3022
AlmaLinux:9motif2.3.4-28.el9ALSA-2024:2217
AlmaLinux:8motif-devel2.3.4-20.el8ALSA-2024:3022
AlmaLinux:9motif-devel2.3.4-28.el9ALSA-2024:2217
AlmaLinux:8motif-static2.3.4-20.el8ALSA-2024:3022
Alpine:v3.20libxpm3.5.17-r0ALPINE-CVE-2023-43789
Alpine:v3.21libxpm3.5.17-r0ALPINE-CVE-2023-43789
Alpine:v3.22libxpm3.5.17-r0ALPINE-CVE-2023-43789
Alpine:v3.23libxpm3.5.17-r0ALPINE-CVE-2023-43789
Alpine:v3.24libxpm3.5.17-r0ALPINE-CVE-2023-43789
Debian:12libxpm1:3.5.12-1.1+deb12u1DSA-5516-1
Debian:12libxpm1:3.5.12-1.1+deb12u1DEBIAN-CVE-2023-43789
Debian:13libxpm1:3.5.17-1DEBIAN-CVE-2023-43789
Debian:14libxpm1:3.5.17-1DEBIAN-CVE-2023-43789
Rocky Linux:8libXpm0:3.5.12-11.el8RLSA-2024:2974
Rocky Linux:9libXpm0:3.5.13-10.el9RLSA-2024:2146
Rocky Linux:8motif0:2.3.4-20.el8RLSA-2024:3022
Rocky Linux:9motif0:2.3.4-28.el9RLSA-2024:2217
Ubuntu:22.04:LTSlibxpm1:3.5.12-1ubuntu0.22.04.2USN-6408-1
Ubuntu:22.04:LTSlibxpm1:3.5.12-1ubuntu0.22.04.2UBUNTU-CVE-2023-43789
Ubuntu:24.04:LTSlibxpm1:3.5.12-1.1ubuntu1UBUNTU-CVE-2023-43789
Ubuntu:22.04:LTSmotifno fix listedUBUNTU-CVE-2023-43789
Ubuntu:24.04:LTSmotifno fix listedUBUNTU-CVE-2023-43789
Ubuntu:25.10motifno fix listedUBUNTU-CVE-2023-43789
Ubuntu:26.04:LTSmotifno fix listedUBUNTU-CVE-2023-43789
Ubuntu:26.10motifno fix listedUBUNTU-CVE-2023-43789

Affected products (as reported)

VendorProductVersions
libXpm 0 – before 3.5.17
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References