Unscored severity · published Oct 20, 2004
CVE-2004-0688
Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm…
–
CVSS
7.2%
EPSS
No
On KEV
Description
Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openbsd · Openbsd
3.4; 3.5 · source: NVD
SL
Suse Linux · Suse
8; 8.1; 8.2; 9.0; 9.0; 9.0; +1 more · source: NVD
X1
X11r6 · X.org
6.7.0; 6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0688
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924
ftp.x.org
http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch
lists.apple.com
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
marc.info
http://marc.info/?l=bugtraq&m=109530851323415&w=2
scary.beasts.org
http://scary.beasts.org/security/CESA-2004-003.txt
secunia.com
http://secunia.com/advisories/20235
More from Openbsd
9.8
CVE-2024-10934
OpenBSD NFS double-free vulnerability
9.8
CVE-2024-29937
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to…
9.8
CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3
9.8
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes…
9.8
CVE-2020-16088
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches