Red Hat Product Errata RHSA-2023:0381 - Security Advisory
Issued:
2023-01-23
Updated:
2023-01-23

RHSA-2023:0381 - Security Advisory

Synopsis

Important: libXpm security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libXpm is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

X.Org X11 libXpm runtime library.

Security Fix(es):

  • libXpm: compression commands depend on $PATH (CVE-2022-4883)
  • libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)
  • libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2160092 - CVE-2022-46285 libXpm: Infinite loop on unclosed comments
  • BZ - 2160193 - CVE-2022-44617 libXpm: Runaway loop on width of 0 and enormous height
  • BZ - 2160213 - CVE-2022-4883 libXpm: compression commands depend on $PATH

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
x86_64
libXpm-3.5.13-8.el9_0.i686.rpm SHA-256: 7f396690156a7371707d3e5820c18a2a0e363ac8772fedab781ff3001bb71043
libXpm-3.5.13-8.el9_0.x86_64.rpm SHA-256: 2294ea32429a2d285ae9f4b9231b7d46814b713076448db7644501c735e2c6a8
libXpm-debuginfo-3.5.13-8.el9_0.i686.rpm SHA-256: c82e943c887285c860ae735b36ee30c5cfa80fc5cf2d174efad3c229a124e1b9
libXpm-debuginfo-3.5.13-8.el9_0.x86_64.rpm SHA-256: 81c73d27f0d14c84a1d730a970a3ea7fe25cde98e1c6787cf64e4bb197298e74
libXpm-debugsource-3.5.13-8.el9_0.i686.rpm SHA-256: 236c65a02305974d7baa5af72808d2be9eb97fd6b9b3266ffb196d8079f8365f
libXpm-debugsource-3.5.13-8.el9_0.x86_64.rpm SHA-256: a472cf87af282417f090b228db365ef5cc3f3a4e2cebcaa45cdb23d70335795f
libXpm-devel-3.5.13-8.el9_0.i686.rpm SHA-256: 77021908997250e4542b58806a1aab78946d74789339111725e9e42034e2627a
libXpm-devel-3.5.13-8.el9_0.x86_64.rpm SHA-256: 88d63140e151f32f2d2ef06cab6fcab12f2189058e6316c715f684be731d4ed6
libXpm-devel-debuginfo-3.5.13-8.el9_0.i686.rpm SHA-256: 567adf398eb7ba51c06ef9aee79cd0be6693faad153d97e5c136b77f3662e414
libXpm-devel-debuginfo-3.5.13-8.el9_0.x86_64.rpm SHA-256: 81a1a2734364dafeb8ec684a465e757e9878bd5321bfeee154e87383fe43196a

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
s390x
libXpm-3.5.13-8.el9_0.s390x.rpm SHA-256: a42c7995c48c5c948d059eaa6b4048d3ac557a725948820692729b2fc302971a
libXpm-debuginfo-3.5.13-8.el9_0.s390x.rpm SHA-256: 7fe531b135cdea33f2e07b43912b20d26da02e9c4d0426f8461e4e0ce72aa6c9
libXpm-debugsource-3.5.13-8.el9_0.s390x.rpm SHA-256: 93b7fc9161bdd7f578b57998aac2c7a92c21f30f208d7292df5b92c694eb1963
libXpm-devel-3.5.13-8.el9_0.s390x.rpm SHA-256: b2bf0de9f37b9ff35fde818cc9180fd46f4ff197e2e2fe6f8644344e93b64304
libXpm-devel-debuginfo-3.5.13-8.el9_0.s390x.rpm SHA-256: f7230ebc2448245686cd740b84fd1d2836e78c12881c34587eed0bea3e52aecc

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
ppc64le
libXpm-3.5.13-8.el9_0.ppc64le.rpm SHA-256: d9fd4dff9e6af52f1cfeac0d242491d1445b43422dc11a82d7c333d324d2fad2
libXpm-debuginfo-3.5.13-8.el9_0.ppc64le.rpm SHA-256: ef9d6407741516e31611c5bf2a316de132351bab2a294d812d969fac068aa6f8
libXpm-debugsource-3.5.13-8.el9_0.ppc64le.rpm SHA-256: b6540e57778e155a2d7903ca835df7ada88d16993fd67bcc60ef686b82bb2df7
libXpm-devel-3.5.13-8.el9_0.ppc64le.rpm SHA-256: 6f3929a27088316301e1af466e39f8ca6a984c61611e7413286eb60c4148c5a9
libXpm-devel-debuginfo-3.5.13-8.el9_0.ppc64le.rpm SHA-256: 3fc259f7e4e86f1af0b9c31f8c6914ea523ebcbaf86799b84bb8404031b8f035

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
aarch64
libXpm-3.5.13-8.el9_0.aarch64.rpm SHA-256: a45f80f1dfb2ede10b8f3401917666a477cdf75aa3e2a6c9932ec48352d4b70a
libXpm-debuginfo-3.5.13-8.el9_0.aarch64.rpm SHA-256: 73de21b78d93cde18116ceeea1b3aefe4a57772eb7095712459f121b51dbd4e8
libXpm-debugsource-3.5.13-8.el9_0.aarch64.rpm SHA-256: 7672c722f99298f827ef0f85bcafe5181622f4b8ab6b62a6efb9ff95704bd81d
libXpm-devel-3.5.13-8.el9_0.aarch64.rpm SHA-256: e60a919890cec21d9fcbed1ab2aebcb902c371de1c0957ddf7bbe220e01e06c4
libXpm-devel-debuginfo-3.5.13-8.el9_0.aarch64.rpm SHA-256: ff02877933f3bdce9235247e0cf031501469c4daa047399fc3876bd078fbea57

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
ppc64le
libXpm-3.5.13-8.el9_0.ppc64le.rpm SHA-256: d9fd4dff9e6af52f1cfeac0d242491d1445b43422dc11a82d7c333d324d2fad2
libXpm-debuginfo-3.5.13-8.el9_0.ppc64le.rpm SHA-256: ef9d6407741516e31611c5bf2a316de132351bab2a294d812d969fac068aa6f8
libXpm-debugsource-3.5.13-8.el9_0.ppc64le.rpm SHA-256: b6540e57778e155a2d7903ca835df7ada88d16993fd67bcc60ef686b82bb2df7
libXpm-devel-3.5.13-8.el9_0.ppc64le.rpm SHA-256: 6f3929a27088316301e1af466e39f8ca6a984c61611e7413286eb60c4148c5a9
libXpm-devel-debuginfo-3.5.13-8.el9_0.ppc64le.rpm SHA-256: 3fc259f7e4e86f1af0b9c31f8c6914ea523ebcbaf86799b84bb8404031b8f035

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
x86_64
libXpm-3.5.13-8.el9_0.i686.rpm SHA-256: 7f396690156a7371707d3e5820c18a2a0e363ac8772fedab781ff3001bb71043
libXpm-3.5.13-8.el9_0.x86_64.rpm SHA-256: 2294ea32429a2d285ae9f4b9231b7d46814b713076448db7644501c735e2c6a8
libXpm-debuginfo-3.5.13-8.el9_0.i686.rpm SHA-256: c82e943c887285c860ae735b36ee30c5cfa80fc5cf2d174efad3c229a124e1b9
libXpm-debuginfo-3.5.13-8.el9_0.x86_64.rpm SHA-256: 81c73d27f0d14c84a1d730a970a3ea7fe25cde98e1c6787cf64e4bb197298e74
libXpm-debugsource-3.5.13-8.el9_0.i686.rpm SHA-256: 236c65a02305974d7baa5af72808d2be9eb97fd6b9b3266ffb196d8079f8365f
libXpm-debugsource-3.5.13-8.el9_0.x86_64.rpm SHA-256: a472cf87af282417f090b228db365ef5cc3f3a4e2cebcaa45cdb23d70335795f
libXpm-devel-3.5.13-8.el9_0.i686.rpm SHA-256: 77021908997250e4542b58806a1aab78946d74789339111725e9e42034e2627a
libXpm-devel-3.5.13-8.el9_0.x86_64.rpm SHA-256: 88d63140e151f32f2d2ef06cab6fcab12f2189058e6316c715f684be731d4ed6
libXpm-devel-debuginfo-3.5.13-8.el9_0.i686.rpm SHA-256: 567adf398eb7ba51c06ef9aee79cd0be6693faad153d97e5c136b77f3662e414
libXpm-devel-debuginfo-3.5.13-8.el9_0.x86_64.rpm SHA-256: 81a1a2734364dafeb8ec684a465e757e9878bd5321bfeee154e87383fe43196a

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
aarch64
libXpm-3.5.13-8.el9_0.aarch64.rpm SHA-256: a45f80f1dfb2ede10b8f3401917666a477cdf75aa3e2a6c9932ec48352d4b70a
libXpm-debuginfo-3.5.13-8.el9_0.aarch64.rpm SHA-256: 73de21b78d93cde18116ceeea1b3aefe4a57772eb7095712459f121b51dbd4e8
libXpm-debugsource-3.5.13-8.el9_0.aarch64.rpm SHA-256: 7672c722f99298f827ef0f85bcafe5181622f4b8ab6b62a6efb9ff95704bd81d
libXpm-devel-3.5.13-8.el9_0.aarch64.rpm SHA-256: e60a919890cec21d9fcbed1ab2aebcb902c371de1c0957ddf7bbe220e01e06c4
libXpm-devel-debuginfo-3.5.13-8.el9_0.aarch64.rpm SHA-256: ff02877933f3bdce9235247e0cf031501469c4daa047399fc3876bd078fbea57

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
libXpm-3.5.13-8.el9_0.src.rpm SHA-256: 4cdda874b963476ee1f74e9a977d3258a7e9e2354f359a6b337f5a6882bb0165
s390x
libXpm-3.5.13-8.el9_0.s390x.rpm SHA-256: a42c7995c48c5c948d059eaa6b4048d3ac557a725948820692729b2fc302971a
libXpm-debuginfo-3.5.13-8.el9_0.s390x.rpm SHA-256: 7fe531b135cdea33f2e07b43912b20d26da02e9c4d0426f8461e4e0ce72aa6c9
libXpm-debugsource-3.5.13-8.el9_0.s390x.rpm SHA-256: 93b7fc9161bdd7f578b57998aac2c7a92c21f30f208d7292df5b92c694eb1963
libXpm-devel-3.5.13-8.el9_0.s390x.rpm SHA-256: b2bf0de9f37b9ff35fde818cc9180fd46f4ff197e2e2fe6f8644344e93b64304
libXpm-devel-debuginfo-3.5.13-8.el9_0.s390x.rpm SHA-256: f7230ebc2448245686cd740b84fd1d2836e78c12881c34587eed0bea3e52aecc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.