Bug 891209 (CVE-2022-44617, CVE-2022-46285, CVE-2022-4883) – <x11-libs/libXpm-3.5.16: multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2023-01-17 17:18:58 UTC]

"1) CVE-2022-46285: Infinite loop on unclosed comments
2) CVE-2022-44617: Runaway loop on width of 0 and enormous height
3) CVE-2022-4883: compression commands depend on $PATH"

Please bump to 3.5.15.

[Comment 1 Sam James 2023-02-05 16:46:19 UTC]

ping. I did take a look at this but couldn't do it myself as was unsure what to do wrt new config options.

[Comment 2 Larry the Git Cow 2023-04-17 20:35:00 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=414462335909ac1cdfa276058238304228c7b129

commit 414462335909ac1cdfa276058238304228c7b129
Author:     Matt Turner <[e-mail]>
AuthorDate: 2023-04-17 20:33:54 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2023-04-17 20:34:56 +0000

    x11-libs/libXpm: Version bump to 3.5.16
    
    Bug: https://bugs.gentoo.org/891209
    Signed-off-by: Matt Turner <[e-mail]>

 x11-libs/libXpm/Manifest             |  1 +
 x11-libs/libXpm/libXpm-3.5.16.ebuild | 41 ++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

[Comment 3 Matt Turner 2024-01-18 18:13:53 UTC]

commit 08bafdc67f518b3159d0ae291d6a8bfe29f95213
Author: Matt Turner <[e-mail]>
Date:   Mon Jun 5 11:30:22 2023 -0400

    x11-libs/libXpm: Drop old versions

[Comment 4 Larry the Git Cow 2024-08-07 05:22:27 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d249388c2be16bdcae27a37364e00167f2e41221

commit d249388c2be16bdcae27a37364e00167f2e41221
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-08-07 05:22:06 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-08-07 05:22:24 +0000

    [ GLSA 202408-03 ] libXpm: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/891209
    Bug: https://bugs.gentoo.org/915130
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202408-03.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)