CVE-2016-10164 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or ex...
CriticalCVSS 9.8
EPSS 7.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxpm(Debian:12) | < 1:3.5.12-1 | 1:3.5.12-1 |
| debian/libxpm(Debian:13) | < 1:3.5.12-1 | 1:3.5.12-1 |
| debian/libxpm(Debian:14) | < 1:3.5.12-1 | 1:3.5.12-1 |
| x.org libXpm | <= 3.5.11 | No fix listed |
| alpine/libxpm(Alpine:v3.2) | < 3.5.12-r0 | 3.5.12-r0 |
| alpine/libxpm(Alpine:v3.3) | < 3.5.12-r0 | 3.5.12-r0 |
| alpine/libxpm(Alpine:v3.4) | < 3.5.12-r0 | 3.5.12-r0 |
References
- Debian Security Tracker CVE-2016-10164 vendor-advisory
- DSA-3772 vendor-advisory
- [oss-security] 20170122 CVE Request: libXpm < 3.5.12 heap overflow mailing-list patch third-party-advisory
- [oss-security] 20170125 Re: CVE Request: libXpm < 3.5.12 heap overflow mailing-list patch third-party-advisory
- 95785 third-party-advisory vdb-entry
- RHSA-2017:1865 vendor-advisory
- cgit.freedesktop.org issue-tracking patch third-party-advisory
- [xorg] 20161215 [ANNOUNCE] libXpm 3.5.12 issue-tracking mailing-list patch third-party-advisory
- GLSA-201701-72 vendor-advisory
- security.alpinelinux.org vendor-advisory