CVE-2022-44617

Name
CVE-2022-44617
Description
A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://bugzilla.redhat.com/show_bug.cgi?id=2160193
MISC https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
MISC https://lists.x.org/archives/xorg-announce/2023-January/003312.html
MISC https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
MLIST https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libxpm_project:libxpm:*:*:*:*:*:*:*:* libxpm >= None < 3.5.15

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxpm 3.17-main 3.5.15-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libxpm 3.16-main 3.5.15-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libxpm 3.15-main 3.5.15-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libxpm 3.14-main 3.5.15-r0 Natanael Copa <ncopa@alpinelinux.org> fixed