CVE-2004-0688
Summary
| CVE | CVE-2004-0688 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2004-10-20 04:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Openbsd | Openbsd | 3.4 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.5 | All | All | All |
| Operating System | Suse | Suse Linux | 8 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 8.1 | All | All | All |
| Operating System | Suse | Suse Linux | 8.2 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 9.0 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.1 | All | All | All |
| Application | X.org | X11r6 | 6.7.0 | All | All | All |
| Application | X.org | X11r6 | 6.8 | All | All | All |
| Application | Xfree86 Project | X11r6 | 3.3.6 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.0 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.0.1 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.0.2.11 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.0.3 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.1.0 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.1.11 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.1.12 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.2.0 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.2.1 | All | All | All |
| Application | Xfree86 Project | X11r6 | 4.2.1 | All | errata | All |
| Application | Xfree86 Project | X11r6 | 4.3.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | ftp.x.org | |
| Resend: APPLE-SA-2005-05-03 Security Update 2005-005 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| libXpm Image Decoding Multiple Remote Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch, Vendor Advisory |
| US-CERT Technical Cyber Security Alert TA05-136A -- Apple Mac OS X is affected by multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | US Government Resource |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| scary.beasts.org/security/CESA-2004-003.txt | af854a3a-2127-422b-91ae-364da2661108 | scary.beasts.org | |
| Debian -- Security Information -- DSA-560-1 lesstif1-1 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| US-CERT Vulnerability Note VU#537878 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | US Government Resource |
| #57653: libXpm Security Vulnerabilities Affect the Motif Library (libXm) | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - HP-UX Motif Applications libXpm Image Decoding Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| USN-27-1: libxpm4 vulnerability | Ubuntu security notices | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Gentoo Linux Documentation -- X.org, XFree86: Integer and stack overflows in libXpm | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| [FLSA-2006:152803] Updated lesstif packages fix security issues | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Gentoo Linux Documentation -- OpenMotif: Multiple vulnerabilities in libXpm | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Advisories - Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Home - Conectiva | af854a3a-2127-422b-91ae-364da2661108 | distro.conectiva.com.br | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| 'CESA-2004-004: libXpm' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
There are currently no legacy QID mappings associated with this CVE.