Bug 31425 - libxpm new security issues CVE-2022-4883, CVE-2022-44617, and CVE-2022-46285
Summary: libxpm new security issues CVE-2022-4883, CVE-2022-44617, and CVE-2022-46285
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-01-18 00:55 CET by David Walser
Modified: 2025-01-18 17:40 CET (History)
5 users (show)

See Also:
Source RPM: libxpm-3.5.13-2.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2023-01-18 00:55:30 CET
X.org has issued an advisory today (January 17):
https://lists.x.org/archives/xorg-announce/2023-January/003312.html

The issues are fixed upstream in 3.5.15:
https://lists.x.org/archives/xorg-announce/2023-January/003313.html

Cauldron has been updated.
Comment 1 David Walser 2023-01-18 19:36:51 CET
Ubuntu has issued an advisory for this on January 17:
https://ubuntu.com/security/notices/USN-5807-1
Comment 2 Lewis Smith 2023-01-18 21:11:59 CET
(In reply to David Walser from comment #0)
> The issues are fixed upstream in 3.5.15:
> Cauldron has been updated.
Thanks David.

For Mageia 8 assigning globally, no packager in sight for this SRPM.

Assignee: bugsquad => pkg-bugs

Comment 3 David Walser 2023-01-23 22:21:40 CET
Fedora has issued an advisory for this on January 22:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BJ2J3EVQMPPSES6ILLTGGH5XVLNDMCRP/

Status comment: (none) => Fixed upstream in 3.5.15

David Walser 2023-01-23 22:21:59 CET

Severity: normal => critical

Comment 4 Nicolas Salguero 2023-01-24 10:31:57 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

libXpm incorrectly handled calling external helper binaries.  If libXpm was being used by a setuid binary, a local attacker could possibly use this issue to escalate privileges. (CVE-2022-4883)

libXpm incorrectly handled certain XPM files.  If a user or automated system were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-44617, CVE-2022-46285)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4883
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-44617
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46285
https://lists.x.org/archives/xorg-announce/2023-January/003312.html
https://lists.x.org/archives/xorg-announce/2023-January/003313.html
https://ubuntu.com/security/notices/USN-5807-1
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BJ2J3EVQMPPSES6ILLTGGH5XVLNDMCRP/
========================

Updated packages in core/updates_testing:
========================
lib(64)xpm4-3.5.15-1.mga8
lib(64)xpm-devel-3.5.15-1.mga8

from SRPM:
libxpm-3.5.15-1.mga8.src.rpm

Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED
CC: (none) => nicolas.salguero
Status comment: Fixed upstream in 3.5.15 => (none)

Comment 5 Thomas Andrews 2023-01-25 19:55:06 CET
Tested in a MGA8-64 Plasma VirtualBox guest. There were no installation issues.

libXpm is used to handle image files in the XPM format. I looked on the Internet for some sample files, and found them surprisingly difficult to find. But I did find one, an image of a teapot.

So I decided to create them from a couple of my own images, using ImageMagick:

$ convert Airborne.jpg Airborne.xpm
$ convert OneidaGlow.jpg OneidaGlow.xpm
        and
$ convert teapot.xpm teapot.png

Using the "display" command showed all conversions to be successful.

urpmq --whatrequires didn't show ImageMagick as requiring lib64xpm4, but it did show that Gimp requires it. So, I loaded each image, in turn, converted and original, into Gimp, and it displayed each with no issues. All images looked very nearly identical to the originals.

This looks OK to me. Validating. Advisory in Comment 4.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK

Dave Hodgins 2023-02-06 20:46:57 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2023-02-07 01:08:37 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0031.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 7 Peter Dinklage 2024-08-14 05:14:37 CEST Comment hidden (spam)

CC: (none) => slopegameorg

katnatek 2024-08-14 05:21:41 CEST

CC: slopegameorg => (none)

Comment 8 rowan butler 2025-01-18 17:31:01 CET Comment hidden (spam)

CC: (none) => rowanbutler66

katnatek 2025-01-18 17:39:40 CET

CC: rowanbutler66 => (none)

Morgan Leijström 2025-01-18 17:40:01 CET

CC: (none) => fri

Comment 9 Morgan Leijström 2025-01-18 17:40:39 CET
Touché... :)

Note You need to log in before you can comment on or make changes to this bug.