Executive Summary
Summary | |
---|---|
Title | Updated XFree86 packages fix security issues and bugs |
Informations | |||
---|---|---|---|
Name | RHSA-2004:479 | First vendor Publication | 2004-10-06 |
Vendor | RedHat | Last vendor Modification | 2004-10-06 |
Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated XFree86 packages that fix several security issues in libXpm, as well as other bug fixes, are now available for Red Hat Enterprise Linux 2.1. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon. During a source code audit, Chris Evans discovered several stack overflow flaws and an integer overflow flaw in the X.Org libXpm library used to decode XPM (X PixMap) images. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0687, CAN-2004-0688, and CAN-2004-0692 to these issues. These packages also contain a bug fix to lower the RGB output voltage on Dell servers using the ATI Radeon 7000m card. Users are advised to upgrade to these erratum packages which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info): 129797 - Radeon driver (7000m) TVDAC output too high for DELL Server 131121 - CAN-2004-0687/8 libXpm stack and integer overflows. |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2004-479.html |
OVAL Definitions
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for openmotif File : nvt/sles9p5010938.nasl |
2009-10-10 | Name : SLES9: Security update for OpenMotif File : nvt/sles9p5014940.nasl |
2009-10-10 | Name : SLES9: Security update for qt3 File : nvt/sles9p5018833.nasl |
2009-10-10 | Name : SLES9: Security update for openmotif File : nvt/sles9p5020391.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200408-20 (Qt) File : nvt/glsa_200408_20.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200409-34 (X) File : nvt/glsa_200409_34.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200410-09 (lesstif) File : nvt/glsa_200410_09.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-07 (openmotif) File : nvt/glsa_200502_07.nasl |
2008-09-04 | Name : xpm -- image decoding vulnerabilities File : nvt/freebsd_agenda-snow-libs.nasl |
2008-09-04 | Name : FreeBSD Ports: linux-gdk-pixbuf File : nvt/freebsd_linux-gdk-pixbuf.nasl |
2008-09-04 | Name : FreeBSD Ports: linux_base File : nvt/freebsd_linux_base.nasl |
2008-09-04 | Name : FreeBSD Ports: qt File : nvt/freebsd_qt.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 542-1 (qt-copy) File : nvt/deb_542_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 560-1 (lesstif1-1) File : nvt/deb_560_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 561-1 (xfree86) File : nvt/deb_561_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2004-236-01 Qt File : nvt/esoft_slk_ssa_2004_236_01.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
10034 | libXpm ParseAndPutPixels Function Stack Overflow A local overflow exists in libXpm. The ParseAndPutPixels function fails to validate user-supplied input resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
10033 | libXpm ParsePixels Function Integer Overflow A local overflow exists in libXpm. The ParsePixels function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
10032 | libXpm CreateXImage Function Integer Overflow A local overflow exists in libXpm. The CreateXImage function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
10031 | libXpm XpmCreateImageFromXpmImage Function Integer Overflow A local overflow exists in libXpm. The XpmCreateImageFromXpmImage function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
10030 | libXpm xpmParseColors Function Integer Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
10029 | libXpm xpmParseColors Function XPMv2/3 Parsing Stack Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied XPMv2/3 image files resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
10028 | libXpm xpmParseColors Function XPMv1 Parsing Stack Overflow A local overflow exists in libXpm. The xpmParseColors function fails to validate user-supplied XPMv1 image files resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
10027 | libXpm ParsePixels Function Stack Overflow A local overflow exists in libXpm. The ParsePixels function fails to validate user-supplied input resulting in a stack overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity. |
10026 | libXpm ParseAndPutPixels Function Integer Overflow A local overflow exists in libXpm. The ParseAndPutPixels function fails to validate user-supplied input resulting in an integer overflow. With a specially crafted request, a malicious user can cause a denial of service resulting in a loss of availability. |
9036 | Qt XPM Parser NULL Dereference Remote DoS Qt contains a flaw that may allow a remote denial of service. The issue is triggered when a NULL derefernce occurs in the XPM parser, and will result in loss of availability for the system running Qt. No further details have been provided. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2010-01-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0524.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_9399.nasl - Type : ACT_GATHER_INFO |
2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33132.nasl - Type : ACT_GATHER_INFO |
2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33130.nasl - Type : ACT_GATHER_INFO |
2006-06-06 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_33129.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-27-1.nasl - Type : ACT_GATHER_INFO |
2005-09-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-815.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_bf2e7483d3fa440d8c6e8f1f2f018818.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-236-01.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ef253f8b072711d9b45d000c41e2cdad.nasl - Type : ACT_GATHER_INFO |
2005-05-03 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2005-005.nasl - Type : ACT_GATHER_INFO |
2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-07.nasl - Type : ACT_GATHER_INFO |
2005-01-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-004.nasl - Type : ACT_GATHER_INFO |
2004-12-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-537.nasl - Type : ACT_GATHER_INFO |
2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-561.nasl - Type : ACT_GATHER_INFO |
2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-560.nasl - Type : ACT_GATHER_INFO |
2004-11-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-124.nasl - Type : ACT_GATHER_INFO |
2004-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200410-09.nasl - Type : ACT_GATHER_INFO |
2004-10-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-479.nasl - Type : ACT_GATHER_INFO |
2004-10-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-478.nasl - Type : ACT_GATHER_INFO |
2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-542.nasl - Type : ACT_GATHER_INFO |
2004-09-27 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200409-34.nasl - Type : ACT_GATHER_INFO |
2004-09-17 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_034.nasl - Type : ACT_GATHER_INFO |
2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-099.nasl - Type : ACT_GATHER_INFO |
2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-098.nasl - Type : ACT_GATHER_INFO |
2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200408-20.nasl - Type : ACT_GATHER_INFO |
2004-08-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_qt_333.nasl - Type : ACT_GATHER_INFO |
2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-270.nasl - Type : ACT_GATHER_INFO |
2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-271.nasl - Type : ACT_GATHER_INFO |
2004-08-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-414.nasl - Type : ACT_GATHER_INFO |
2004-08-22 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-085.nasl - Type : ACT_GATHER_INFO |
2004-08-20 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_027.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:48:41 |
|