Lucene search

DebianDEBIAN:DSA-3772-1:7FAFA

HistoryJan 26, 2017 - 7:30 p.m.

[SECURITY] [DSA 3772-1] libxpm security update

2017-01-2619:30:27

lists.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.025 Low

EPSS

Percentile

90.2%

JSON

Debian Security Advisory DSA-3772-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
January 26, 2017 https://www.debian.org/security/faq

Package : libxpm
CVE ID : CVE-2016-10164

Tobias Stoeckmann discovered that the libXpm library contained two
integer overflow flaws, leading to a heap out-of-bounds write, while
parsing XPM extensions in a file. An attacker can provide a specially
crafted XPM file that, when processed by an application using the libXpm
library, would cause a denial-of-service against the application, or
potentially, the execution of arbitrary code with the privileges of the
user running the application.

For the stable distribution (jessie), this problem has been fixed in
version 1:3.5.12-0+deb8u1. This update is based on a new upstream
version of libxpm including additional bug fixes.

For the testing distribution (stretch) and the unstable distribution
(sid), this problem has been fixed in version 1:3.5.12-1.

We recommend that you upgrade your libxpm packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-amd64libxpm-dev< 1:3.5.12-0+deb8u1libxpm-dev_1:3.5.12-0+deb8u1_kfreebsd-amd64.deb
Debian8s390xlibxpm4-dbg< 1:3.5.12-0+deb8u1libxpm4-dbg_1:3.5.12-0+deb8u1_s390x.deb
Debian8amd64xpmutils< 1:3.5.12-0+deb8u1xpmutils_1:3.5.12-0+deb8u1_amd64.deb
Debian8kfreebsd-i386xpmutils< 1:3.5.12-0+deb8u1xpmutils_1:3.5.12-0+deb8u1_kfreebsd-i386.deb
Debian8mipsellibxpm4-dbg< 1:3.5.12-0+deb8u1libxpm4-dbg_1:3.5.12-0+deb8u1_mipsel.deb
Debian8kfreebsd-i386libxpm-dev< 1:3.5.12-0+deb8u1libxpm-dev_1:3.5.12-0+deb8u1_kfreebsd-i386.deb
Debian7i386xpmutils< 1:3.5.10-1+deb7u1xpmutils_1:3.5.10-1+deb7u1_i386.deb
Debian8s390xlibxpm-dev< 1:3.5.12-0+deb8u1libxpm-dev_1:3.5.12-0+deb8u1_s390x.deb
Debian8mipsellibxpm4< 1:3.5.12-0+deb8u1libxpm4_1:3.5.12-0+deb8u1_mipsel.deb
Debian8armellibxpm4< 1:3.5.12-0+deb8u1libxpm4_1:3.5.12-0+deb8u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-amd64	libxpm-dev	< 1:3.5.12-0+deb8u1	libxpm-dev_1:3.5.12-0+deb8u1_kfreebsd-amd64.deb
Debian	8	s390x	libxpm4-dbg	< 1:3.5.12-0+deb8u1	libxpm4-dbg_1:3.5.12-0+deb8u1_s390x.deb
Debian	8	amd64	xpmutils	< 1:3.5.12-0+deb8u1	xpmutils_1:3.5.12-0+deb8u1_amd64.deb
Debian	8	kfreebsd-i386	xpmutils	< 1:3.5.12-0+deb8u1	xpmutils_1:3.5.12-0+deb8u1_kfreebsd-i386.deb
Debian	8	mipsel	libxpm4-dbg	< 1:3.5.12-0+deb8u1	libxpm4-dbg_1:3.5.12-0+deb8u1_mipsel.deb
Debian	8	kfreebsd-i386	libxpm-dev	< 1:3.5.12-0+deb8u1	libxpm-dev_1:3.5.12-0+deb8u1_kfreebsd-i386.deb
Debian	7	i386	xpmutils	< 1:3.5.10-1+deb7u1	xpmutils_1:3.5.10-1+deb7u1_i386.deb
Debian	8	s390x	libxpm-dev	< 1:3.5.12-0+deb8u1	libxpm-dev_1:3.5.12-0+deb8u1_s390x.deb
Debian	8	mipsel	libxpm4	< 1:3.5.12-0+deb8u1	libxpm4_1:3.5.12-0+deb8u1_mipsel.deb
Debian	8	armel	libxpm4	< 1:3.5.12-0+deb8u1	libxpm4_1:3.5.12-0+deb8u1_armel.deb