CVE-2022-44617 - Vulnerability Details

Vendors	Products
Redhat	Enterprise Linux Rhel Aus Rhel E4s Rhel Eus Rhel Tus
X.org	Libxpm

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
libXpm-0:3.5.12-9.el8_7	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:0379	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
libXpm-0:3.5.12-9.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2023:0384	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.2 Advanced Update Support
libXpm-0:3.5.12-9.el8_2	cpe:/a:redhat:rhel_aus:8.2	RHSA-2023:0380	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
libXpm-0:3.5.12-9.el8_2	cpe:/a:redhat:rhel_tus:8.2	RHSA-2023:0380	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
libXpm-0:3.5.12-9.el8_2	cpe:/a:redhat:rhel_e4s:8.2	RHSA-2023:0380	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
libXpm-0:3.5.12-9.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2023:0382	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
libXpm-0:3.5.12-9.el8_6	cpe:/a:redhat:rhel_eus:8.6	RHSA-2023:0378	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 9
libXpm-0:3.5.13-8.el9_1	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:0383	2023-01-23T00:00:00Z
Red Hat Enterprise Linux 9.0 Extended Update Support
libXpm-0:3.5.13-8.el9_0	cpe:/a:redhat:rhel_eus:9.0	RHSA-2023:0381	2023-01-23T00:00:00Z

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2160193
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
https://lists.x.org/archives/xorg-announce/2023-January/003312.html
https://nvd.nist.gov/vuln/detail/CVE-2022-44617
https://www.cve.org/CVERecord?id=CVE-2022-44617

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-44617", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2025-03-25T20:05:14.184Z", "dateReserved": "2023-01-09T00:00:00.000Z", "datePublished": "2023-02-06T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-06-20T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library."}], "affected": [{"vendor": "n/a", "product": "libXpm", "versions": [{"version": "3.5.15", "status": "affected"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193"}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28"}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9"}, {"url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html"}, {"name": "[debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-20->CWE-835", "cweId": "CWE-20"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:54:04.007Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193", "tags": ["x_transferred"]}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28", "tags": ["x_transferred"]}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9", "tags": ["x_transferred"]}, {"url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-25T20:01:52.011717Z", "id": "CVE-2022-44617", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T20:05:14.184Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-44617 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

assignerShortName : redhat (string)

dateUpdated : 2025-03-25T20:05:14.184Z (string)

dateReserved : 2023-01-09T00:00:00.000Z (string)

datePublished : 2023-02-06T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-06-20T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : libXpm (string)

versions : [ »

0 : { »

version : 3.5.15 (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

}

1 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

}

2 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

}

3 : { »

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

}

4 : { »

name : [debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update (string)

tags : [ »

0 : mailing-list (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : CWE-20->CWE-835 (string)

cweId : CWE-20 (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:54:04.007Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

name : [debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-25T20:01:52.011717Z (string)

id : CVE-2022-44617 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-25T20:05:14.184Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193", "tags": ["x_transferred"]}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28", "tags": ["x_transferred"]}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9", "tags": ["x_transferred"]}, {"url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html", "name": "[debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:54:04.007Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-44617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-25T20:01:52.011717Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T20:01:25.247Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "libXpm", "versions": [{"status": "affected", "version": "3.5.15"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193"}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28"}, {"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9"}, {"url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html", "name": "[debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20->CWE-835"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-06-20T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-44617", "state": "PUBLISHED", "dateUpdated": "2025-03-25T20:05:14.184Z", "dateReserved": "2023-01-09T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-02-06T00:00:00.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

name : [debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:54:04.007Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-44617 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-25T20:01:52.011717Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-25T20:01:25.247Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : libXpm (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.5.15 (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

}

1 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

}

2 : { »

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

}

3 : { »

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

}

4 : { »

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

name : [debian-lts-announce] 20230620 [SECURITY] [DLA 3459-1] libxpm security update (string)

tags : [ »

0 : mailing-list (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-20 (string)

description : CWE-20->CWE-835 (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-06-20T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-44617 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-25T20:05:14.184Z (string)

dateReserved : 2023-01-09T00:00:00.000Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2023-02-06T00:00:00.000Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:*", "matchCriteriaId": "D98D97AA-EDDE-48F7-B4DE-E51BFB5A72D3", "versionEndExcluding": "3.5.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en libXpm. Al procesar un archivo con un ancho de 0 y una altura muy grande, algunas funciones del analizador se llamar\u00e1n repetidamente y pueden generar un bucle infinito, lo que resultar\u00e1 en una denegaci\u00f3n de servicio en la aplicaci\u00f3n vinculada a la librer\u00eda."}], "id": "CVE-2022-44617", "lastModified": "2025-03-25T20:15:15.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-02-06T23:15:09.787", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193"}, {"source": "secalert@redhat.com", "url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28"}, {"source": "secalert@redhat.com", "url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9"}, {"source": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html"}, {"source": "secalert@redhat.com", "url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D98D97AA-EDDE-48F7-B4DE-E51BFB5A72D3 (string)

versionEndExcluding : 3.5.15 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (string)

}

1 : { »

lang : es (string)

value : Se encontró una falla en libXpm. Al procesar un archivo con un ancho de 0 y una altura muy grande, algunas funciones del analizador se llamarán repetidamente y pueden generar un bucle infinito, lo que resultará en una denegación de servicio en la aplicación vinculada a la librería. (string)

}

]

id : CVE-2022-44617 (string)

lastModified : 2025-03-25T20:15:15.493 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-02-06T23:15:09.787 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

2 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

}

1 : { »

source : secalert@redhat.com (string)

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

}

2 : { »

source : secalert@redhat.com (string)

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

}

3 : { »

source : secalert@redhat.com (string)

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

}

4 : { »

source : secalert@redhat.com (string)

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

2 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-835 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2023:0379", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "libXpm-0:3.5.12-9.el8_7", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0384", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "libXpm-0:3.5.12-9.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0380", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "libXpm-0:3.5.12-9.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0380", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "libXpm-0:3.5.12-9.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0380", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "libXpm-0:3.5.12-9.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0382", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "libXpm-0:3.5.12-9.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0378", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "libXpm-0:3.5.12-9.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0383", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "libXpm-0:3.5.13-8.el9_1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-01-23T00:00:00Z"}, {"advisory": "RHSA-2023:0381", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "libXpm-0:3.5.13-8.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-01-23T00:00:00Z"}], "bugzilla": {"description": "libXpm: Runaway loop on width of 0 and enormous height", "id": "2160193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160193"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-20->CWE-835", "details": ["A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.", "A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library."], "name": "CVE-2022-44617", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libXpm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "libXpm", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-01-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-44617\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-44617\nhttps://lists.x.org/archives/xorg-announce/2023-January/003312.html"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2023:0379 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : libXpm-0:3.5.12-9.el8_7 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-01-23T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2023:0384 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : libXpm-0:3.5.12-9.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2023-01-23T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2023:0380 (string)

cpe : cpe:/a:redhat:rhel_aus:8.2 (string)

package : libXpm-0:3.5.12-9.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Advanced Update Support (string)

release_date : 2023-01-23T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2023:0380 (string)

cpe : cpe:/a:redhat:rhel_tus:8.2 (string)

package : libXpm-0:3.5.12-9.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Telecommunications Update Service (string)

release_date : 2023-01-23T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2023:0380 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.2 (string)

package : libXpm-0:3.5.12-9.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions (string)

release_date : 2023-01-23T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2023:0382 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : libXpm-0:3.5.12-9.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2023-01-23T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2023:0378 (string)

cpe : cpe:/a:redhat:rhel_eus:8.6 (string)

package : libXpm-0:3.5.12-9.el8_6 (string)

product_name : Red Hat Enterprise Linux 8.6 Extended Update Support (string)

release_date : 2023-01-23T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2023:0383 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : libXpm-0:3.5.13-8.el9_1 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2023-01-23T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2023:0381 (string)

cpe : cpe:/a:redhat:rhel_eus:9.0 (string)

package : libXpm-0:3.5.13-8.el9_0 (string)

product_name : Red Hat Enterprise Linux 9.0 Extended Update Support (string)

release_date : 2023-01-23T00:00:00Z (string)

}

]

bugzilla : { »

description : libXpm: Runaway loop on width of 0 and enormous height (string)

id : 2160193 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2160193 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

status : verified (string)

}

cwe : CWE-20->CWE-835 (string)

details : [ »

0 : A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (string)

1 : A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. (string)

]

name : CVE-2022-44617 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : libXpm (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Out of support scope (string)

package_name : libXpm (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

]

public_date : 2023-01-17T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-44617 https://nvd.nist.gov/vuln/detail/CVE-2022-44617 https://lists.x.org/archives/xorg-announce/2023-January/003312.html (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object