Severity
Medium
Vendor
Canonical Ubuntu
Versions Affected
- Canonical Ubuntu 18.04
- Canonical Ubuntu 22.04
Description
Martin Ettl discovered that libXpm incorrectly handled certain XPM files. If a user or automated system were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-44617) Marco Ivaldi discovered that libXpm incorrectly handled certain XPM files. If a user or automated system were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-46285) Alan Coopersmith discovered that libXpm incorrectly handled calling external helper binaries. If libXpm was being used by a setuid binary, a local attacker could possibly use this issue to escalate privileges. (CVE-2022-4883) Update Instructions: Run `sudo pro fix USN-5807-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: xpmutils – 1:3.5.12-1ubuntu0.18.04.2 libxpm-dev – 1:3.5.12-1ubuntu0.18.04.2 libxpm4 – 1:3.5.12-1ubuntu0.18.04.2 No subscription required
CVEs contained in this USN include: CVE-2022-44617, CVE-2022-46285, CVE-2022-4883.
Affected Cloud Foundry Products and Versions
Severity is medium unless otherwise noted.
- cflinuxfs3
-
- All versions prior to 0.351.0
- cflinuxfs4
-
- All versions prior to 0.57.0
- CF Deployment
-
- All versions prior to 26.4.0
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- cflinuxfs3
-
- Upgrade all versions to 0.351.0 or greater
- cflinuxfs4
-
- Upgrade all versions to 0.57.0 or greater
- CF Deployment
-
- Upgrade all versions to 26.4.0 or greater
References
History
2023-02-24: Initial vulnerability report published.
