A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Fedoraproject
  • Fedora
Redhat
  • Enterprise Linux
X.org
  • Libxpm

Configuration 1 [-]

cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
libXpm-0:3.5.12-11.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:2974 2024-05-22T00:00:00Z
motif-0:2.3.4-20.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:3022 2024-05-22T00:00:00Z
Red Hat Enterprise Linux 9
libXpm-0:3.5.13-10.el9 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:2146 2024-04-30T00:00:00Z
motif-0:2.3.4-28.el9 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:2217 2024-04-30T00:00:00Z

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2024:2146 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:2217 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:2974 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3022 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2023-43788 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2242248 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6FARGWN7VWXXWPXYNEEDJLRR3EWFZ3T/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747/ cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-43788 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-43788 cve-icon
History

Mon, 16 Jun 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
References

Mon, 16 Sep 2024 15:45:00 +0000

Type Values Removed Values Added
References
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-08-30T11:57:07.650Z

Reserved: 2023-09-22T09:52:31.109Z

Link: CVE-2023-43788

cve-icon Vulnrichment

Updated: 2024-08-02T19:52:11.310Z

cve-icon NVD

Status : Modified

Published: 2023-10-10T13:15:22.137

Modified: 2024-11-21T08:24:47.003

Link: CVE-2023-43788

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-10-04T00:00:00Z

Links: CVE-2023-43788 - Bugzilla

cve-icon OpenCVE Enrichment

No data.