{"id":106435,"date":"2023-01-21T12:48:20","date_gmt":"2023-01-21T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=106435"},"modified":"2023-01-24T13:53:14","modified_gmt":"2023-01-24T11:53:14","slug":"uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Vulnerability in libXpm leading to code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A corrective release of the libXpm library 3.5.15 has been published, developed by the X.Org project and used for processing files in the XPM format. In the new version, three vulnerabilities have been addressed, two of which (CVE-2022-46285, CVE-2022-44617) lead to infinite looping when processing specially crafted XPM files. The third vulnerability (CVE-2022-4883) allows arbitrary commands to be executed when applications using libXpm run. When launching privileged processes related to libXpm, such as programs with the suid root flag, the vulnerability allows for privilege escalation. <\/p>\n
The vulnerability is caused by the way libXpm works with compressed XPM files \u2014 when processing XPM.Z or XPM.gz files, the library launches external decompression utilities (uncompress or gunzip) using execlp(), with the path determined by the PATH environment variable. The attack involves placing custom executable files for uncompress or gunzip in a user-accessible directory that is listed in the PATH, which will be executed when an application using libXpm is launched. <\/p>\n