crítica
CVE-2016-10164
libXpm: Out-of-bounds write in XPM extension parsing
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.8CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Oracle (media), Ubuntu (media).
Descripción
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | libxpm | 3.5.12-r0 |
| alpine 3.3 | libxpm | 3.5.12-r0 |
| alpine 3.4 | libxpm | 3.5.12-r0 |
| debian 11 | libxpm | 1:3.5.12-1 |
| debian 12 | libxpm | 1:3.5.12-1 |
| debian 13 | libxpm | 1:3.5.12-1 |
| debian 14 | libxpm | 1:3.5.12-1 |
| debian 7 | libxpm | 1:3.5.10-1+deb7u1 |
| debian 8 | libxpm | 1:3.5.12-0+deb8u1 |
| echo | libxpm | 1:3.5.12-1 |
| Oracle Linux 7 | drm-utils, libICE, libICE-devel y 84 más | 2.4.74-1.el7 y 32 más |
| Red Hat | libXpm, libXpm-devel | sin corrección indicada |
Mostrar las 111 entradas de 20 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | libxpm | 3.5.12-r0 |
| alpine 3.3 | libxpm | 3.5.12-r0 |
| alpine 3.4 | libxpm | 3.5.12-r0 |
| debian 11 | libxpm | 1:3.5.12-1 |
| debian 12 | libxpm | 1:3.5.12-1 |
| debian 13 | libxpm | 1:3.5.12-1 |
| debian 14 | libxpm | 1:3.5.12-1 |
| debian 7 | libxpm | 1:3.5.10-1+deb7u1 |
| debian 8 | libxpm | 1:3.5.12-0+deb8u1 |
| echo | libxpm | 1:3.5.12-1 |
| Oracle Linux 7 | drm-utils | 2.4.74-1.el7 |
| Oracle Linux 7 | libICE | 1.0.9-9.el7 |
| Oracle Linux 7 | libICE-devel | 1.0.9-9.el7 |
| Oracle Linux 7 | libX11 | 1.6.5-1.el7 |
| Oracle Linux 7 | libX11-common | 1.6.5-1.el7 |
| Oracle Linux 7 | libX11-devel | 1.6.5-1.el7 |
| Oracle Linux 7 | libXaw | 1.0.13-4.el7 |
| Oracle Linux 7 | libXaw-devel | 1.0.13-4.el7 |
| Oracle Linux 7 | libXcursor | 1.1.14-8.el7 |
| Oracle Linux 7 | libXcursor-devel | 1.1.14-8.el7 |
| Oracle Linux 7 | libXdmcp | 1.1.2-6.el7 |
| Oracle Linux 7 | libXdmcp-devel | 1.1.2-6.el7 |
| Oracle Linux 7 | libXfixes | 5.0.3-1.el7 |
| Oracle Linux 7 | libXfixes-devel | 5.0.3-1.el7 |
| Oracle Linux 7 | libXfont | 1.5.2-1.el7 |
| Oracle Linux 7 | libXfont-devel | 1.5.2-1.el7 |
| Oracle Linux 7 | libXfont2 | 2.0.1-2.el7 |
| Oracle Linux 7 | libXfont2-devel | 2.0.1-2.el7 |
| Oracle Linux 7 | libXi | 1.7.9-1.el7 |
| Oracle Linux 7 | libXi-devel | 1.7.9-1.el7 |
| Oracle Linux 7 | libXpm | 3.5.12-1.el7 |
| Oracle Linux 7 | libXpm-devel | 3.5.12-1.el7 |
| Oracle Linux 7 | libXrandr | 1.5.1-2.el7 |
| Oracle Linux 7 | libXrandr-devel | 1.5.1-2.el7 |
| Oracle Linux 7 | libXrender | 0.9.10-1.el7 |
| Oracle Linux 7 | libXrender-devel | 0.9.10-1.el7 |
| Oracle Linux 7 | libXt | 1.1.5-3.el7 |
| Oracle Linux 7 | libXt-devel | 1.1.5-3.el7 |
| Oracle Linux 7 | libXtst | 1.2.3-1.el7 |
| Oracle Linux 7 | libXtst-devel | 1.2.3-1.el7 |
| Oracle Linux 7 | libXv | 1.0.11-1.el7 |
| Oracle Linux 7 | libXv-devel | 1.0.11-1.el7 |
| Oracle Linux 7 | libXvMC | 1.0.10-1.el7 |
| Oracle Linux 7 | libXvMC-devel | 1.0.10-1.el7 |
| Oracle Linux 7 | libXxf86vm | 1.1.4-1.el7 |
| Oracle Linux 7 | libXxf86vm-devel | 1.1.4-1.el7 |
| Oracle Linux 7 | libdrm | 2.4.74-1.el7 |
| Oracle Linux 7 | libdrm-devel | 2.4.74-1.el7 |
| Oracle Linux 7 | libepoxy | 1.3.1-1.el7 |
| Oracle Linux 7 | libepoxy-devel | 1.3.1-1.el7 |
| Oracle Linux 7 | libevdev | 1.5.6-1.el7 |
| Oracle Linux 7 | libevdev-devel | 1.5.6-1.el7 |
| Oracle Linux 7 | libevdev-utils | 1.5.6-1.el7 |
| Oracle Linux 7 | libfontenc | 1.1.3-3.el7 |
| Oracle Linux 7 | libfontenc-devel | 1.1.3-3.el7 |
| Oracle Linux 7 | libinput | 1.6.3-2.el7 |
| Oracle Linux 7 | libinput-devel | 1.6.3-2.el7 |
| Oracle Linux 7 | libvdpau | 1.1.1-3.el7 |
| Oracle Linux 7 | libvdpau-devel | 1.1.1-3.el7 |
| Oracle Linux 7 | libvdpau-docs | 1.1.1-3.el7 |
| Oracle Linux 7 | libwacom | 0.24-1.el7 |
| Oracle Linux 7 | libwacom-data | 0.24-1.el7 |
| Oracle Linux 7 | libwacom-devel | 0.24-1.el7 |
| Oracle Linux 7 | libxcb | 1.12-1.el7 |
| Oracle Linux 7 | libxcb-devel | 1.12-1.el7 |
| Oracle Linux 7 | libxcb-doc | 1.12-1.el7 |
| Oracle Linux 7 | libxkbcommon | 0.7.1-1.el7 |
| Oracle Linux 7 | libxkbcommon-devel | 0.7.1-1.el7 |
| Oracle Linux 7 | libxkbcommon-x11 | 0.7.1-1.el7 |
| Oracle Linux 7 | libxkbcommon-x11-devel | 0.7.1-1.el7 |
| Oracle Linux 7 | libxkbfile | 1.0.9-3.el7 |
| Oracle Linux 7 | libxkbfile-devel | 1.0.9-3.el7 |
| Oracle Linux 7 | mesa-dri-drivers | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-filesystem | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libEGL | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libEGL-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libGL | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libGL-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libGLES | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libGLES-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libOSMesa | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libOSMesa-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libgbm | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libgbm-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libglapi | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libxatracker | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-libxatracker-devel | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | mesa-private-llvm | 3.9.1-3.el7 |
| Oracle Linux 7 | mesa-private-llvm-devel | 3.9.1-3.el7 |
| Oracle Linux 7 | mesa-vulkan-drivers | 17.0.1-6.20170307.el7 |
| Oracle Linux 7 | vulkan | 1.0.39.1-2.el7 |
| Oracle Linux 7 | vulkan-devel | 1.0.39.1-2.el7 |
| Oracle Linux 7 | vulkan-filesystem | 1.0.39.1-2.el7 |
| Oracle Linux 7 | xcb-proto | 1.12-2.el7 |
| Oracle Linux 7 | xkeyboard-config | 2.20-1.el7 |
| Oracle Linux 7 | xkeyboard-config-devel | 2.20-1.el7 |
| Oracle Linux 7 | xorg-x11-proto-devel | 7.7-20.el7 |
| Red Hat | libXpm | sin corrección indicada |
| Red Hat | libXpm-devel | sin corrección indicada |
| seal Red Hat 6 | libx11 | 1.6.4-4.el6_10+sp999 |
| seal Red Hat 6 | libxcursor | 1.1.14-2.1.el6+sp999 |
| seal Red Hat 6 | seal-libx11 | 1.6.4-4.el6_10+sp999 |
| seal Red Hat 6 | seal-libxcursor | 1.1.14-2.1.el6+sp999 |
| seal Red Hat 7 | libxpm | 3.5.12-1.el7+sp999, 3.5.12-2.el7_9+sp999 |
| seal Red Hat 7 | seal-libxpm | 3.5.12-1.el7+sp999, 3.5.12-2.el7_9+sp999 |
| ubuntu 12.04 | libxpm | 1:3.5.9-4ubuntu0.1 |
| ubuntu 14.04 | libxpm | 1:3.5.10-1ubuntu0.1 |
| ubuntu 14.04-ESM | libxpm | 1:3.5.10-1ubuntu0.1 |
| ubuntu 16.04 | libxpm | 1:3.5.11-1ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | libxpm | 1:3.5.11-1ubuntu0.16.04.1 |
| ubuntu 16.10 | libxpm | 1:3.5.11-1ubuntu0.16.10.1 |
Referencias
- http://www.debian.org/security/2017/dsa-3772
- http://www.openwall.com/lists/oss-security/2017/01/22/2
- http://www.openwall.com/lists/oss-security/2017/01/25/7
- http://www.securityfocus.com/bid/95785
- https://access.redhat.com/errata/RHSA-2017:1865
- https://access.redhat.com/security/cve/CVE-2016-10164
- https://cgit.freedesktop.org/xorg/lib/libXpm/commit/?id=d1167418f0fd02a27f617ec5afd6db053afbe185
- https://linux.oracle.com/cve/CVE-2016-10164.html
Las 14 referencias
- https://linux.oracle.com/errata/ELSA-2017-1865.html
- https://lists.freedesktop.org/archives/xorg/2016-December/058537.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-10164
- https://security.gentoo.org/glsa/201701-72
- https://ubuntu.com/security/notices/USN-3185-1
- https://www.cve.org/CVERecord?id=CVE-2016-10164