A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
References
Configurations
History
20 Mar 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| References | () https://lists.x.org/archives/xorg-announce/2023-January/003312.html - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2160213 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html - | |
| References | () https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 - | |
| References | () https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669 - |
17 Oct 2023, 15:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:* | |
| First Time |
X.org
X.org libxpm |
|
| CWE | CWE-426 |
20 Jun 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| References |
|
Information
Published : 2023-02-07 19:15
Updated : 2025-03-20 20:15
NVD link : CVE-2022-4883
Mitre link : CVE-2022-4883
JSON object : View
Products Affected
x.org
- libxpm
CWE
No CWE.