Security update for libXpm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0165-1 Final 1 1 2023-01-26T17:26:48Z current 2023-01-26T17:26:48Z 2023-01-26T17:26:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libXpm This update for libXpm fixes the following issues: - CVE-2022-46285: Fixed an infinite loop that could be triggered when reading a XPM image with a C-style comment that is never closed (bsc#1207029). - CVE-2022-44617: Fixed an excessive resource consumption that could be triggered when reading small crafted XPM image (bsc#1207030). - CVE-2022-4883: Fixed an issue that made decompression commands susceptible to PATH environment variable manipulation attacks (bsc#1207031). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-SAP-BYOS-2023-165,Image SLES12-SP5-Azure-SAP-On-Demand-2023-165,Image SLES12-SP5-EC2-SAP-BYOS-2023-165,Image SLES12-SP5-EC2-SAP-On-Demand-2023-165,Image SLES12-SP5-GCE-SAP-BYOS-2023-165,Image SLES12-SP5-GCE-SAP-On-Demand-2023-165,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2023-165,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2023-165,SUSE-2023-165,SUSE-OpenStack-Cloud-9-2023-165,SUSE-OpenStack-Cloud-Crowbar-9-2023-165,SUSE-SLE-SAP-12-SP4-2023-165,SUSE-SLE-SDK-12-SP5-2023-165,SUSE-SLE-SERVER-12-SP2-BCL-2023-165,SUSE-SLE-SERVER-12-SP4-LTSS-2023-165,SUSE-SLE-SERVER-12-SP5-2023-165 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230165-1/ Link for SUSE-SU-2023:0165-1 https://lists.suse.com/pipermail/sle-security-updates/2023-January/013537.html E-Mail link for SUSE-SU-2023:0165-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207029 SUSE Bug 1207029 https://bugzilla.suse.com/1207030 SUSE Bug 1207030 https://bugzilla.suse.com/1207031 SUSE Bug 1207031 https://www.suse.com/security/cve/CVE-2022-44617/ SUSE CVE CVE-2022-44617 page https://www.suse.com/security/cve/CVE-2022-46285/ SUSE CVE CVE-2022-46285 page https://www.suse.com/security/cve/CVE-2022-4883/ SUSE CVE CVE-2022-4883 page Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libXpm4-3.5.11-6.7.1 libXpm-devel-3.5.11-6.7.1 libXpm-devel-32bit-3.5.11-6.7.1 libXpm-devel-64bit-3.5.11-6.7.1 libXpm-tools-3.5.11-6.7.1 libXpm4-32bit-3.5.11-6.7.1 libXpm4-64bit-3.5.11-6.7.1 libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libXpm4-3.5.11-6.7.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libXpm4-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libXpm4-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libXpm4-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP5 libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server 12 SP5 libXpm4-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libXpm4-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libXpm-devel-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libXpm-tools-3.5.11-6.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libXpm4-3.5.11-6.7.1 as a component of SUSE OpenStack Cloud 9 libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE OpenStack Cloud 9 libXpm4-3.5.11-6.7.1 as a component of SUSE OpenStack Cloud Crowbar 9 libXpm4-32bit-3.5.11-6.7.1 as a component of SUSE OpenStack Cloud Crowbar 9 A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-44617 Image SLES12-SP5-Azure-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-Azure-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-devel-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-tools-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-32bit-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-32bit-3.5.11-6.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230165-1/ https://www.suse.com/security/cve/CVE-2022-44617.html CVE-2022-44617 https://bugzilla.suse.com/1207030 SUSE Bug 1207030 https://bugzilla.suse.com/1214751 SUSE Bug 1214751 A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library. CVE-2022-46285 Image SLES12-SP5-Azure-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-Azure-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-devel-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-tools-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-32bit-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-32bit-3.5.11-6.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230165-1/ https://www.suse.com/security/cve/CVE-2022-46285.html CVE-2022-46285 https://bugzilla.suse.com/1207029 SUSE Bug 1207029 https://bugzilla.suse.com/1214751 SUSE Bug 1214751 https://bugzilla.suse.com/1215682 SUSE Bug 1215682 https://bugzilla.suse.com/1215686 SUSE Bug 1215686 A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. CVE-2022-4883 Image SLES12-SP5-Azure-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-Azure-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-EC2-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-BYOS:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-GCE-SAP-On-Demand:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libXpm4-3.5.11-6.7.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP2-BCL:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-3.5.11-6.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libXpm4-32bit-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-devel-3.5.11-6.7.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libXpm-tools-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud 9:libXpm4-32bit-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-3.5.11-6.7.1 SUSE OpenStack Cloud Crowbar 9:libXpm4-32bit-3.5.11-6.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230165-1/ https://www.suse.com/security/cve/CVE-2022-4883.html CVE-2022-4883 https://bugzilla.suse.com/1207031 SUSE Bug 1207031 https://bugzilla.suse.com/1208055 SUSE Bug 1208055 https://bugzilla.suse.com/1208351 SUSE Bug 1208351 https://bugzilla.suse.com/1208654 SUSE Bug 1208654 https://bugzilla.suse.com/1209322 SUSE Bug 1209322 https://bugzilla.suse.com/1209940 SUSE Bug 1209940