The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0011 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-44617:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-46285:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-4883:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5807-1 advisory.

    Martin Ettl discovered that libXpm incorrectly handled certain XPM files. If a user or automated system     were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to     cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-44617)

    Marco Ivaldi discovered that libXpm incorrectly handled certain XPM files. If a user or automated system     were tricked into opening a specially crafted XPM file, a remote attacker could possibly use this issue to     cause libXpm to stop responding, resulting in a denial of service. (CVE-2022-46285)

    Alan Coopersmith discovered that libXpm incorrectly handled calling external helper binaries. If libXpm     was being used by a setuid binary, a local attacker could possibly use this issue to escalate privileges.
    (CVE-2022-4883)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0381 advisory.

    X.Org X11 libXpm runtime library.

    Security Fix(es):

    * libXpm: compression commands depend on $PATH (CVE-2022-4883)

    * libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)

    * libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0380 advisory.

    X.Org X11 libXpm runtime library.

    Security Fix(es):

    * libXpm: compression commands depend on $PATH (CVE-2022-4883)

    * libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)

    * libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0379 advisory.

    - Fix CVE-2022-46285: infinite loop on unclosed comments (#2161800)
    - Fix CVE-2022-44617: runaway loop with width of 0 (#2161808)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0383 advisory.

  - libXpm: compression commands depend on $PATH (CVE-2022-4883)

  - libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)

  - libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0171-1 advisory.

    - CVE-2022-46285: Fixed an infinite loop that could be triggered       when reading a XPM image with a C-style comment that is never       closed (bsc#1207029).
    - CVE-2022-44617: Fixed an excessive resource consumption that could       be triggered when reading small crafted XPM image (bsc#1207030).
    - CVE-2022-4883: Fixed an issue that made decompression commands       susceptible to PATH environment variable manipulation attacks       (bsc#1207031).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libXpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libXpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library. (CVE-2022-44617)

  - A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library. (CVE-2022-46285)

  - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable. (CVE-2022-4883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3459 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3459-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Bastien Roucaris     June 20, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libxpm     Version        : 1:3.5.12-1+deb10u1     CVE ID         : CVE-2022-4883 CVE-2022-44617 CVE-2022-46285

    libxpm is a library handling X PixMap image format (so called xpm files).
    xpm files are an extension of the monochrome X BitMap format specified     in the X protocol, and is commonly used in traditional X applications.

    CVE-2022-4883

        When processing files with         .Z or .gz extensions, the library calls external programs         to compress and uncompress files, relying on the         PATH environment variable to find these programs,         which could allow a malicious user to execute other programs         by manipulating the PATH environment variable.

    CVE-2022-44617

        When processing a file with width of 0         and a very large height, some parser functions will be         called repeatedly and can lead to an infinite loop,         resulting in a Denial of Service in the application linked         to the library.

    CVE-2022-46285

        When parsing a file with a comment         not closed, an end-of-file condition will not be detected,         leading to an infinite loop and resulting in a         Denial of Service in the application linked to the library.

    For Debian 10 buster, these problems have been fixed in version     1:3.5.12-1+deb10u1.

    We recommend that you upgrade your libxpm packages.

    For the detailed security status of libxpm please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxpm

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-03 (libXpm: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libXpm. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0016 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-46285:
      A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-     file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in     the application linked to the library.

      CVE-2022-44617:
      A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser     functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in     the application linked to the library.

      CVE-2022-4883:
      A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external     programs to compress and uncompress files, relying on the PATH environment variable to find these     programs, which could allow a malicious user to execute other programs by manipulating the PATH     environment variable.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5006:03 advisory.

    * libXpm: compression commands depend on $PATH (CVE-2022-4883)
      * libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)
      * libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
236503	Alibaba Cloud Linux 3 : 0011: libXpm (ALINUX3-SA-2023:0011)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
170110	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : libXpm vulnerabilities (USN-5807-1)	Nessus	Ubuntu Local Security Checks	2023/1/17	2024/8/27	high
170449	RHEL 9 : libXpm (RHSA-2023:0381)	Nessus	Red Hat Local Security Checks	2023/1/24	2024/11/7	high
170465	RHEL 8 : libXpm (RHSA-2023:0380)	Nessus	Red Hat Local Security Checks	2023/1/24	2024/11/7	high
170517	Oracle Linux 8 : libXpm (ELSA-2023-0379)	Nessus	Oracle Linux Local Security Checks	2023/1/24	2024/10/22	high
170599	AlmaLinux 9 : libXpm (ALSA-2023:0383)	Nessus	Alma Linux Local Security Checks	2023/1/25	2023/2/17	high
170706	SUSE SLED15: libXpm-devel / libXpm-devel-32bit / libXpm-tools / libXpm4 / etc (SUSE-SU-2023:0171-1)	Nessus	SuSE Local Security Checks	2023/1/27	2026/6/26	high
175767	EulerOS Virtualization 2.10.0 : libXpm (EulerOS-SA-2023-1937)	Nessus	Huawei Local Security Checks	2023/5/16	2023/5/16	high
177076	EulerOS 2.0 SP5 : libXpm (EulerOS-SA-2023-2158)	Nessus	Huawei Local Security Checks	2023/6/9	2023/6/9	high
177152	EulerOS Virtualization 3.0.6.0 : libXpm (EulerOS-SA-2023-2253)	Nessus	Huawei Local Security Checks	2023/6/13	2023/6/13	high
177457	Debian dla-3459 : libxpm-dev - security update	Nessus	Debian Local Security Checks	2023/6/20	2025/1/22	high
178898	EulerOS Virtualization 3.0.6.6 : libXpm (EulerOS-SA-2023-2430)	Nessus	Huawei Local Security Checks	2023/7/26	2023/7/26	high
205135	GLSA-202408-03 : libXpm: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/8/7	2024/8/7	high
238877	TencentOS Server 3: libXpm (TSSA-2023:0016)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
293553	MiracleLinux 9 : libXpm-3.5.13-8.el9 (AXSA:2023-5006:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high