CVE-2022-4883
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, rel...
Original description
The description as published by the source.
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-4883 libxpm Fixed in: 3.5.15-r0
- BellSoft Alpaquita BELL-CVE-2022-4883
- Debian DEBIAN-CVE-2022-4883 libxpm Fixed in: 1:3.5.12-1.1~deb11u1
- Ubuntu UBUNTU-CVE-2022-4883 libxpm
References
- advisory github.com
- advisory nvd.nist.gov
- patch gitlab.freedesktop.org
- patch gitlab.freedesktop.org
- report bugzilla.redhat.com
- web lists.x.org
- web lists.debian.org