|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2004:098: libxpm4 Vulnerability Scan
Vulnerability Scan Summary Check for the version of the libxpm4 package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2004:098 (libxpm4).
Chris Evans found several stack and integer overflows in the libXpm code of
X.Org/XFree86 (from which the libxpm code is derived):
Stack overflows (CVE-2004-0687):
Careless use of strcat() in both the XPMv1 and XPMv2/3 xpmParseColors code leads
to a stack based overflow (parse.c).
Stack overflow reading pixel values in ParseAndPutPixels (create.c) as well as
ParsePixels (parse.c).
Integer Overflows (CVE-2004-0688):
Integer overflow allocating colorTable in xpmParseColors (parse.c) - probably a
crashable but not exploitable offence.
The updated packages have patches from Chris Evans and Matthieu Herrb to address
these vulnerabilities.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2004:098
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|