Opened 3 weeks ago

Closed 3 weeks ago

#24134 closed enhancement (fixed)

libXpm-3.5.20 (Xorg library)

Reported by: Bruce Dubbs Owned by: SecurityAdvisory
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

New point version.

Change History (3)

comment:1 by Joe Locash, 3 weeks ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 3 weeks ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Priority: normal → elevated
Severity: normal → medium
Status: assigned → new 
libXpm - X Pixmap (XPM) image file format library
-------------------------------------------------

This release fixes CVE-2026-94287.  For more information, see the advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003752.html

Alan Coopersmith (1):
      libXpm 3.5.20

Olivier Fourdan (3):
      ParsePixels: reject zero-dimension XPM images
      Revert "ParsePixels: reject zero-dimension XPM images"
      ParsePixels: reject zero-dimension XPM images

git tag: libXpm-3.5.20

From ​https://lists.x.org/archives/xorg-announce/2026-October/003752.html 

========================================================================
libXpm - 1 CVE
========================================================================

* CVE-2026-94287:
  Denial of service via unsigned underflow in libXpm's write path.

  A crafted 0x0 XPM passes the parser's dimension checks and, when
  serialized through WritePixels(), causes an unsigned underflow in the
  row loop bound (height - 1 wraps to UINT_MAX), resulting in prolonged
  CPU use and continuous output growth.

  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — 5.5 (MEDIUM)

  Fixed in: libXpm 3.5.20
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/58eb875b7
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14424)

Fixed at 629e346c71. Leaving open for SA.

comment:3 by Bruce Dubbs, 3 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.1-075 has been issued. This advisory covers five related Xorg libraries.

Note: See TracTickets for help on using tickets.