CVE-2022-4883
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, rel...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2022-4883 libxpm 修正版: 3.5.15-r0
- BellSoft Alpaquita BELL-CVE-2022-4883
- Debian DEBIAN-CVE-2022-4883 libxpm 修正版: 1:3.5.12-1.1~deb11u1
- Ubuntu UBUNTU-CVE-2022-4883 libxpm
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch gitlab.freedesktop.org
- patch gitlab.freedesktop.org
- report bugzilla.redhat.com
- web lists.x.org
- web lists.debian.org