Early Access — Mondoo Vulnerability Intelligence is currently in preview.

SUSE-SU-2023:0171-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2023:0171-1

UNKNOWN

Security update for libXpm

Published Jan 26, 2023

Modified 2 years ago

Fix available

Details

This update for libXpm fixes the following issues:

CVE-2022-46285: Fixed an infinite loop that could be triggered when reading a XPM image with a C-style comment that is never closed (bsc#1207029).
CVE-2022-44617: Fixed an excessive resource consumption that could be triggered when reading small crafted XPM image (bsc#1207030).
CVE-2022-4883: Fixed an issue that made decompression commands susceptible to PATH environment variable manipulation attacks (bsc#1207031).

Affected Packages

SUSE:Enterprise Storage 6libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 6libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 6libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7.1libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7.1libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Enterprise Storage 7.1libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Module for Basesystem 15 SP4libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Module for Basesystem 15 SP4libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Module for Basesystem 15 SP4libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Module for Package Hub 15 SP4libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Module for Package Hub 15 SP4libXpm4-32bit

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Real Time 15 SP3libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Real Time 15 SP3libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Real Time 15 SP3libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP1-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP1-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP1-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP2-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP2-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP2-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP3-LTSSlibXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP3-LTSSlibXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server 15 SP3-LTSSlibXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP1libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP1libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP1libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP2libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP2libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP2libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP3libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP3libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Server for SAP Applications 15 SP3libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Workstation Extension 15 SP4libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Linux Enterprise Workstation Extension 15 SP4libXpm-tools

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Proxy 4.2libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Proxy 4.2libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Proxy 4.2libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Retail Branch Server 4.2libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Retail Branch Server 4.2libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Retail Branch Server 4.2libXpm4

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Server 4.2libXpm

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Server 4.2libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

SUSE:Manager Server 4.2libXpm4

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm-devel

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm-devel-32bit

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm-tools

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm4

Fixed in:

3.5.12-150000.3.7.2

openSUSE:Leap 15.4libXpm4-32bit

Fixed in:

3.5.12-150000.3.7.2

References

REPORThttps://bugzilla.suse.com/1207029 REPORThttps://bugzilla.suse.com/1207030 REPORThttps://bugzilla.suse.com/1207031 WEBhttps://www.suse.com/security/cve/CVE-2022-44617 WEBhttps://www.suse.com/security/cve/CVE-2022-46285 WEBhttps://www.suse.com/security/cve/CVE-2022-4883 ADVISORYhttps://www.suse.com/support/update/announcement/2023/suse-su-20230171-1/

Upstream

CVE-2022-44617 CVE-2022-46285 CVE-2022-4883

Related

CVE-2022-44617 CVE-2022-46285 CVE-2022-4883

Ecosystems

SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.4

Timeline

PublishedJan 26, 2023

ModifiedJan 26, 2023