CVE-2022-46285: High severity suse libxpm vulnerability
A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.
Other sources
When reading XPM images from a file with libXpm 3.5.14 or older, if a comment in the file is not closed (i.e. a C-style comment starts with "/" and is missing the closing "/"), the ParseComment() function will loop forever calling getc() to try to read the rest of the comment, failing to notice that it has returned EOF, which may cause a denial of service to the calling program.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-46285?
CVE-2022-46285 is a vulnerability in libXpm that can lead to a Denial of Service (DoS) attack due to an infinite loop caused by parsing a file with an unclosed comment.
How does CVE-2022-46285 affect the application?
CVE-2022-46285 can cause a Denial of Service (DoS) in the application linked to libXpm.
What is the severity of CVE-2022-46285?
CVE-2022-46285 has a severity rating of 7.5, which is classified as high.
Which versions of libXpm are affected by CVE-2022-46285?
Versions 1:3.5.11-1ubuntu0.16.04.1+ to 1:3.5.12-1ubuntu0.22.10.1 of libXpm are affected by CVE-2022-46285.
How can I fix CVE-2022-46285?
To fix CVE-2022-46285, it is recommended to update libXpm to version 3.5.15 or apply the specific remedies provided by the respective distribution or vendor.