UbuntuUpdates.org

Package "xpmutils"

Name: xpmutils

Description:

X11 pixmap utilities
Latest version: 1:3.5.12-1ubuntu0.22.04.4
Release: jammy (22.04)
Level: security
Repository: universe
Head package: libxpm
Homepage: https://www.x.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "xpmutils"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "xpmutils" in Jammy

Repository Area Version
base universe 1:3.5.12-1build2
updates universe 1:3.5.12-1ubuntu0.22.04.4

Changelog

Version: 1:3.5.12-1ubuntu0.22.04.4 2026-10-01 15:07:46 UTC

libxpm (1:3.5.12-1ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: infinite write loop
    - debian/patches/CVE-2026-94287.patch: ParsePixels: reject zero-dimension
      XPM images in src/parse.c.
    - CVE-2026-94287

 -- Marc Deslauriers Tue, 29 Sep 2026 11:57:56 -0400
Source diff to previous version
CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usa

Version: 1:3.5.12-1ubuntu0.22.04.3 2026-07-23 17:08:17 UTC
No changelog available yet.
Source diff to previous version

Version: 1:3.5.12-1ubuntu0.22.04.2 2023-10-03 19:10:15 UTC

  libxpm (1:3.5.12-1ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: stack exhaustion from infinite recursion in
    PutSubImage() in libx11
    - d/p/0004-test-Add-test-case-for-CVE-2023-43786-stack-exhausti.patch
    - d/p/0005-Avoid-CVE-2023-43786-stack-exhaustion-in-XPutImage.patch
    - CVE-2023-43786
  * SECURITY UPDATE: integer overflow in XCreateImage() leading to a heap
    overflow in libx11
    - d/p/0006-test-Add-test-case-for-CVE-2023-43787-integer-overfl.patch
    - d/p/0007-Avoid-CVE-2023-43787-integer-overflow-in-XCreateImag.patch
    - CVE-2023-43787
  * SECURITY UPDATE: out of bounds read in XpmCreateXpmImageFromBuffer()
    - d/p/0001-Fix-CVE-2023-43788-Out-of-bounds-read-in-XpmCreateXp.patch
    - CVE-2023-43788
  * SECURITY UPDATE: out of bounds read on XPM with corrupted colormap
    - d/p/0003-Fix-CVE-2023-43789-Out-of-bounds-read-on-XPM-with-co.patch
    - CVE-2023-43789

 -- Marc Deslauriers <email address hidden> Mon, 02 Oct 2023 16:10:52 -0400
Source diff to previous version
CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage()
CVE-2023-43787 ibX11: integer overflow in XCreateImage() leading to a heap overflow
CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()
CVE-2023-43789 libXpm: out of bounds read on XPM with corrupted colormap

Version: 1:3.5.12-1ubuntu0.22.04.1 2023-01-17 19:07:51 UTC

  libxpm (1:3.5.12-1ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: CPU-consuming loop on width of 0
    - debian/patches/CVE-2022-44617-1.patch: add extra checks to
      src/data.c, src/parse.c.
    - debian/patches/CVE-2022-44617-2.patch: prevent a double free in the
      error code path in src/create.c.
    - CVE-2022-44617
  * SECURITY UPDATE: Infinite loop on unclosed comments
    - debian/patches/CVE-2022-46285.patch: handle unclosed comments in
      src/data.c.
    - CVE-2022-46285
  * SECURITY UPDATE: compression commands depend on $PATH
    - debian/patches/CVE-2022-4883.patch: don't rely on $PATH to find the
      commands in src/RdFToI.c, src/WrFFrI.c.
    - CVE-2022-4883

 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2023 12:38:49 -0500


About   -   Send Feedback to @ubuntu_updates