CVE-2016-10164
Published: 31 December 2016
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
Notes
| Author | Note |
|---|---|
| tyhicks |
See oss-security thread for a test case |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libxpm
Launchpad, Ubuntu, Debian |
precise |
Released
(1:3.5.9-4ubuntu0.1)
|
| trusty |
Released
(1:3.5.10-1ubuntu0.1)
|
|
| upstream |
Released
(1:3.5.12-1)
|
|
| xenial |
Released
(1:3.5.11-1ubuntu0.16.04.1)
|
|
| yakkety |
Released
(1:3.5.11-1ubuntu0.16.10.1)
|
|
|
Patches:
upstream: https://cgit.freedesktop.org/xorg/lib/libXpm/commit/?id=d1167418f0fd02a27f617ec5afd6db053afbe185 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |