ELSA-2024-2146

ELSA-2024-2146 - libXpm security update

Type:	SECURITY
Severity:	MODERATE
Release Date:	2024-05-02

Description

[3.5.13-10]
- Drop hardening patches from previous version to keep ABI compatibility

[3.5.13-9]
- CVE-2023-43786 libX11: stack exhaustion from infinite recursion
in PutSubImage()
- CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to
a heap overflow
- CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()
- CVE-2023-43789 libXpm: out of bounds read on XPM with corrupted colormap

Related CVEs

CVE-2023-43788

CVE-2023-43789

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	libXpm-3.5.13-10.el9.src.rpm	06bf1895fd7022d3bf9029061d92255b	-	ol9_aarch64_appstream
	libXpm-3.5.13-10.el9.aarch64.rpm	e36c740b0929e6b3ab3724099cbb0f65	-	ol9_aarch64_appstream
	libXpm-devel-3.5.13-10.el9.aarch64.rpm	0533ca8d550fe09c325424feff52ca87	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	libXpm-3.5.13-10.el9.src.rpm	06bf1895fd7022d3bf9029061d92255b	-	ol9_x86_64_appstream
	libXpm-3.5.13-10.el9.i686.rpm	3ee16cd4c23046fc53303215d4e4fa15	-	ol9_x86_64_appstream
	libXpm-3.5.13-10.el9.x86_64.rpm	a3fd0d9859b3b4b322abf831e751609c	-	ol9_x86_64_appstream
	libXpm-devel-3.5.13-10.el9.i686.rpm	da481e3e99fb6fd8d7a7723897d2c2c8	-	ol9_x86_64_appstream
	libXpm-devel-3.5.13-10.el9.x86_64.rpm	ff872acfe5333aec32c3f79d5e393f40	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team