Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2004:098: libxpm4 Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the libxpm4 package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2004:098 (libxpm4).
Chris Evans found several stack and integer overflows in the libXpm code of
X.Org/XFree86 (from which the libxpm code is derived):
Stack overflows (CVE-2004-0687):
Careless use of strcat() in both the XPMv1 and XPMv2/3 xpmParseColors code leads
to a stack based overflow (parse.c).
Stack overflow reading pixel values in ParseAndPutPixels (create.c) as well as
Integer Overflows (CVE-2004-0688):
Integer overflow allocating colorTable in xpmParseColors (parse.c) - probably a
crashable but not exploitable offence.
The updated packages have patches from Chris Evans and Matthieu Herrb to address
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2004:098
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.