USN-6408-1: libXpm vulnerabilities

Severity

Medium

Vendor

Canonical Ubuntu

Description

Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to consume memory, leading to a denial of service. (CVE-2023-43786) Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could use this issue to cause libXpm to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2023-43787) Alan Coopersmith discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to cause libXpm to crash, leading to a denial of service. (CVE-2023-43788, CVE-2023-43789) Update Instructions: Run `sudo pro fix USN-6408-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: xpmutils – 1:3.5.12-1ubuntu0.20.04.2 libxpm-dev – 1:3.5.12-1ubuntu0.20.04.2 libxpm4 – 1:3.5.12-1ubuntu0.20.04.2 No subscription required

CVEs contained in this USN include: CVE-2023-43786, CVE-2023-43787, CVE-2023-43788, CVE-2023-43789.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs4
  • All versions prior to 1.40.0
• CF Deployment
  • All versions prior to 32.12.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs4
  • Upgrade all versions to 1.40.0 or greater
• CF Deployment
  • Upgrade all versions to 32.12.0 or greater

History

2023-10-05: Initial vulnerability report published.